Sign a container image with Sigstore cosign keyless signing (Fulcio + Rekor) and verify it

Steps

1. Ensure cosign v2.x is installed; in v2.x keyless signing is the default behavior and no special flags or environment variables are needed to enable it.
2. Run `cosign sign <image-digest>` (using the image digest reference, e.g., registry/image@sha256:...) — cosign will automatically initiate an OIDC authentication flow (browser-based or ambient credentials in CI) to obtain an identity token.
3. cosign uses the OIDC token to request a short-lived signing certificate from Fulcio, signs the image, and records the signature and certificate to the Rekor transparency log; the certificate is not stored by the caller.
4. To verify a signed image, run `cosign verify --certificate-identity <expected-identity> --certificate-oidc-issuer <issuer-url> <image-digest>`; cosign checks the Rekor log and validates the certificate chain.
5. In CI environments, ambient OIDC credentials (e.g., GitHub Actions OIDC token) are picked up automatically; no browser prompt occurs and no long-lived keys are stored.
6. Optionally use `cosign verify-attestation` for SBOM or SLSA provenance attestations attached to the image, applying the same --certificate-identity and --certificate-oidc-issuer flags.