Addtional Tasks for Software Supply Chain Security

While many Software Supply Chain Security (SCSS) controls are already implemented (signing, SBOMs, provenance, scanning), several important items remain unaddressed. This issue tracks the missing measures across the six domains.

### Attention: This is just a more or less complete list of SCSS measurements. It is not required to fulfill all of those.

---

### Authenticity
**Covered:**
- Image Signing

**Missing:**
- [ ] Deploy-time Signature Verification (see also #45)
- [x] [Attest SBOM with cosign](https://edu.chainguard.dev/open-source/sigstore/cosign/how-to-sign-an-sbom-with-cosign/)
- [x] Provenance Attestations (in-toto/SLSA) (if not already done by #34)
- [x] Attest Provenance with cosign
---

### Reproducibility
**Covered:**
- Build Caching

**Missing:**
- [ ] Pinned Base Images (by digest)
- [ ] Pin package versions (APT, pip, R)
- [ ] Deterministic Builds (deploy by digest)
- [ ] Add reproducible builds verification

---
### Transparency & Auditability
**Covered:**
- SBOM Generation
- Vulnerability Reports

**Missing:**
- [x] Provenance Records
- [ ] Integrate transparency logs (Rekor)
- [ ] Enable public auditing of reports by storing them as github artifacts
- [ ] Enable long-term artifact archival

---
### Dependency Governance
**Covered:**
- Trusted Registries
- Base Image Digest Tracking
- Vulnerability Scanning

**Missing:**
- [ ] Implement license compliance checks
- [ ] Enforce policy gates on CVE severity

---
### Deployment & Runtime
**Covered:**
- Non-Root Containers
- Healthchecks

**Missing:**
- [ ] Apply CIS Docker benchmarks
- [ ] Add runtime threat detection

---
### Risk Management
**Covered:**
- Automated Release Workflows
- Versioned Updates

**Missing:**
- [ ] Define CVE severity thresholds
- [ ] Configure license allow/deny lists
- [ ] Establish waiver process for exceptions
- [ ] Track compliance metrics

---
### Other
- [ ] Add [Scorecard](https://github.com/ossf/scorecard) to repo
- [ ] Add proper [Docker Compose Linter](https://github.com/zavoloklom/docker-compose-linter)
- [ ] Recheck how long all workflow artifacts are stored
- [ ] add Linting with Dockle/Hadolint