v9.2.0 — qcow2-bake component + supply-chain/brand housekeeping New `qcow2-bake` component: converts a promoted bootc image to a qcow2 disk image via bootc-image-builder, in the same standalone-invocation shape as `installer-anaconda-iso` (separate CI config, web/API/manual trigger, Package Registry publish). Produces the disk image only; boot-verifying it needs /dev/kvm and stays a consumer-owned gate on a self-managed nested-KVM lane. Additive, no consumer behavior change. Housekeeping in the same release: - Dropped the dead cosign install (and COSIGN_VERSION/COSIGN_YES) from the buildah-fedora builder image; signing left the catalog in v4.3.0 and cairn's real signing path is the seal component. - Pinned syft via a syft_version component input instead of fetching releases/latest at CI runtime, with a matching Renovate customManager. - Pinned the remaining floating third-party :latest image refs (buildah, skopeo, docker/dind, bootc-image-builder) to version/digest. - Dropped two unreferenced pre-cairn brand PNGs.