Add signed image provenance and admission verification

[leonwwest]

Add build provenance and signature verification. Acceptance criteria: image is signed with keyless identity; policy rejects unsigned images in production overlay; local developer path is documented; verification remains reproducible in CI.