- Add Cosign signatures and SLSA Level 3 provenance for images and CLI binaries, with verification documentation.
- Fix OIDC config via secrets, reduce excessive remote ls requests on monorepos with auto‑sync, and improve tar.gzip handling in compressed layer extraction.
- Update Go dependencies to v1.25.6 and adjust CI to exclude testdata from Sonar analysis.
