`instance` gains opt-in verification of a signed/attested promote digest against a consumer-committed cosign public key. When a consumer sets `verify_pubkey_path` to a repo-relative path and `sign_on_promote`/`attest_on_promote` ran, promote runs `cosign verify` and/or `cosign verify-attestation` against that key immediately after signing/attesting, and fails the job on mismatch -- turning signing-key vs committed-pubkey drift into a red job instead of a silently unverifiable artifact (the incident class `cairn/example-evidence`'s D6 documents). Off by default; no behavior change for existing consumers. Also lands a loudness/verbosity hardening pass across `promote`, `detect-changes`, and the release tooling, closing several silent-skip gaps a gate-vacuity audit found: a masked-vs-genuine registry failure in `promote`'s digest resolution, an unparseable-vs-absent SBOM in the same job, undocumented decision inputs in `detect-changes`, and pass-path silence in `release-check`/`release-create`/`publish-one` that made a green run harder to audit than a red one. Additive, opt-in, no behavior change for existing consumers. Minor bump. - `instance` input `verify_pubkey_path` (default `""`). Fails closed if set to a path that doesn't exist. - `promote`'s `SRC_DIGEST` resolution now distinguishes a benign manifest-unknown/404 (documented "nothing to promote" skip) from any other registry/auth failure, which now fails loud with the captured stderr instead of silently resolving to "no digest". - `promote`'s SBOM component count is now a checked assignment; an unparseable (but present) `sbom.json` fails the job instead of surfacing as an empty count inline in the echo. - `promote`'s attest block echoes a `cosign verify-attestation` reproduction line per predicate type after each successful attest. - `detect-changes` echoes `BASE_CONFIG`/`PREVIOUS_BASE_CONFIG`/ `BASE_IMAGE_CHANGED` before writing `changes.env`, and notes when an unreadable `:latest` is being treated as changed. - `justfile` `release-check`'s pass path now names each matched file:line (kickstart/summary clone refs, seal `catalog_ref`, README pin count), matching the STALE path's existing offender-naming. - `justfile` `release-create` echoes its notes source (tag message vs fallback), the previous tag, and the commit count before calling the Releases API. - `justfile` `publish-one` resolves and echoes the pushed digest after push, so the log states what `:vX.Y.Z`/`:latest` now resolve to. - `.gitlab-ci.yml`'s `consumers-aligned` job (repo-CI, not shipped to consumers) got the same hardening ahead of this tag: the group-listing API call and both per-consumer file-read calls now fail loud instead of silently reading as "no refs", and the per-ref loop prints every consumer's actual pinned ref. - `templates/summary.yml`'s `allow_failure: true` now carries its rationale comment (summary is reporting-only and must never block the lane it reports on), matching the documentation discipline elsewhere in the catalog.