v9.3.0 — opt-in own-key cosign sign-at-promote (instance)
The `instance` promote job can now sign the promoted image digest with
an own cosign key when a consumer sets `sign_on_promote: "true"`
(cosign v2, `--tlog-upload=false`, key from protected+masked group
vars). Own-key signing verifies at pull time against a committed public
key, unlike the keyless flow dropped in v4.3.0, so a reject-by-default
`sigstoreSigned` policy.json (cairn/example-evidence) can finally
enforce. Off by default; existing instance consumers are unaffected.
- inputs `sign_on_promote` (default "false") and `cosign_version` ("2.6.3").
- Digest signed once; matchRepository covers :latest and :stable.
- cosign pinned to v2.x (v3 refuses --tlog-upload=false; example-evidence D4).
- Validated sim-first: sign + verify + reject-by-default policy matrix
against an ephemeral registry with cosign v2.