Sign a container image keylessly with cosign and attach the signature to the registry using the cosign sign command

Steps

1. Authenticate to the container registry where the image is stored using standard registry credential mechanisms such as docker login or a workload identity credential
2. Run 'cosign sign --yes <image>@<digest>' referencing the image by its immutable digest rather than a mutable tag to ensure the signature is tied to the exact image content
3. Confirm that cosign obtains an OIDC token from the ambient identity provider, requests a certificate from Fulcio, and records the signature to Rekor
4. Verify the signature was pushed to the registry as an OCI referrer by running 'cosign verify <image>@<digest> --certificate-identity <identity> --certificate-oidc-issuer <issuer>'
5. Ensure downstream consumers reference images by digest when verifying, as tag-based references are mutable and may point to a different image than what was signed