fix(signing): cosign-pubkey + SBOM + deployment/env-poster för prod-imagen prod-2419b76eb2

siax/production-evidence/pe-sbom-0pt-f6a29da7e586.json

@@ -1,12 +0,0 @@
-{
-  "id": "pe-sbom-0pt-f6a29da7e586",
-  "repo": "0pt",
-  "evidenceType": "sbom",
-  "result": "pass",
-  "verifiedAt": "2026-09-23T16:22:09Z",
-  "verifiedBy": "syft (estate-kampanj issue #76, skannad vid deployad commit)",
-  "proofRef": "siax/sbom/sbom-0pt-f6a29da7e586.json",
-  "sourceSha": "f6a29da7e58601ce426181b11ea4959e90f07dcc",
-  "tool": "syft",
-  "sbomFormat": "cyclonedx-json"
-}

siax/signing/README.md

@@ -1,4 +1,4 @@
 # 0pt — cosign-signeringskedjan (2026-09-29)
 
-Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-09b9cc80bf (sha256:8a1649c7418c8728e6793ff885814a266f055114f950e31ca9d7b252645dedd3) är cosign-signerad
+Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-2419b76eb2 (sha256:82bd3751669119e4cf806f9053d76463316157856a31144188902ee36cb7cba7) är cosign-signerad
 med nyckelparet vars pubkey ligger här. Privata nyckeln raderad efter signering.

siax/signing/cosign.pub

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXES2u9EA2vFf6aQS5Hg/hsjudCJk
-mC1G/IFtBOzweyPlQD+A84UcYDJmxIR5Cfq5t8nvF3bY/ff18AhhK+WZmw==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEknnvwkO/YDVKCP7Nan6W8VoN2D2J
+bEx1cxYmhbhrPrc3VUAU8mAlkrk4yiFbe7TDPYuopW8A91qr7EMTzTdsQw==
 -----END PUBLIC KEY-----