Transparency

We publish:

• Build logs (sanitized), image hashes, and signatures.
• Changelogs mapping upstream OTAs to our signed image releases.
• Reproducibility goals and current coverage.

ASCII: build -> sign -> publish

┌───────┐   ┌───────┐   ┌──────┐   ┌─────────┐
│ Build │ → │ Tests │ → │ Sign │ → │ Publish │
└───────┘   └───────┘   └──────┘   └─────────┘