`instance` gains opt-in cosign attestation at promote, alongside the existing opt-in signing. When a consumer sets `attest_on_promote: "true"`, the promote job attests the promoted image digest with the estate cosign key: a CycloneDX SBOM predicate (reuses `sbom.json`, the same build artifact promote's SBOM-reuse check already validates) and a minimal SLSA v1 provenance predicate built inline from CI env vars (ref, sha, project, builder id, pipeline URL). Same own-key, no-Rekor posture as `sign_on_promote` (`--tlog-upload=false`, cosign v2 pinned), and shares its cosign install + decoded key -- the binary installs once when either input is opted in. Off by default; no behavior change for existing consumers. Additive, opt-in, no behavior change for existing consumers. Minor bump. - `instance` input `attest_on_promote` (default `"false"`). - Promote attests the digest once per predicate type; `:latest` and `:stable` both point at it, so one SBOM attestation and one provenance attestation cover every tag in the repo. - The attester fails closed if opted in but the protected group vars (`COSIGN_PRIVATE_KEY_B64`/`COSIGN_PASSWORD`) are absent, same as `sign_on_promote`. - `cosign attest --type slsaprovenance1` confirmed accepted by cosign 2.6.3. - `container-build.yml`'s header comment claimed build→push→sign→SBOM→attest; corrected to build→push→SBOM, matching what the script actually does (it has neither a sign nor an attest step). - README.md: dropped the stale "Current series: `@v9.x`" line and updated the Related section to point at `cairn/base` and the four `example-*` vignettes instead of the retired `immutable/basef` and `immutable/instance`. - Template doc-comment version literals in `supply-chain.yml`, `base-build-scratch.yml`, `seal/template.yml`, `installer-anaconda-iso/template.yml`, and `qcow2-bake/template.yml` replaced with a `@vX.Y.Z` placeholder plus a pointer to this CHANGELOG, so a usage-example pin can no longer go stale in place. `instance.yml`'s dated `immutable/pipeline` postmortem citation is a historical reference, not a usage pin, and was left as-is. - `justfile`'s `release-check` recipe now also fails on series-style literals (`@v9.x`) in README.md, the class that let the stale "Current series" line above survive three releases unnoticed.