chore(ops): signed images, a secret gate before commit, and a monthly restore drill

Published manifests are now cosign-signed keyless with a documented
digest-pinning path, a lefthook pre-commit runs gitleaks over staged
changes, responses opt into a credentialless embedder policy, the
deploy webhook can require a fresh timestamp, and a monthly drill
decrypts and parses the newest offhost backup so a broken key or format
surfaces before an emergency does.

.github/workflows/docker-publish.yml

@@ -268,6 +268,12 @@ jobs:
     permissions:
       contents: read
       packages: write
+      # v1.16.4 — keyless image signing. The job requests an OIDC
+      # token from GitHub's issuer; cosign exchanges it for a
+      # short-lived Fulcio certificate bound to this workflow identity
+      # and records the signature in the Rekor transparency log. No
+      # long-lived signing key exists anywhere in this pipeline.
+      id-token: write
 
     steps:
       - name: Download digest artifacts
@@ -333,6 +339,35 @@ jobs:
         run: |
           docker buildx imagetools inspect '${{ env.IMAGE_REF }}:${{ steps.meta.outputs.version }}'
 
+      # v1.16.4 — sign the multi-arch manifest index (keyless, Sigstore).
+      # Signing the INDEX digest covers both per-platform manifests in
+      # one signature, and the digest is the only stable identity — every
+      # tag (`:latest`, `:1.16.4`, …) is a mutable alias that a registry
+      # compromise could repoint. Operators verify with:
+      #
+      #   cosign verify \
+      #     --certificate-identity-regexp 'https://github.com/MBombeck/HealthLog/\.github/workflows/docker-publish\.yml@refs/tags/v.*' \
+      #     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+      #     ghcr.io/mbombeck/healthlog:<tag>
+      #
+      # See docs/ops/deploy.md ("Verify the image signature") for the
+      # digest-pinned deploy recommendation that pairs with this.
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign multi-arch manifest (keyless)
+        env:
+          IMAGE_VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          digest="$(docker buildx imagetools inspect "${IMAGE_REF}:${IMAGE_VERSION}" --format '{{json .Manifest.Digest}}' | tr -d '"')"
+          if [ -z "$digest" ]; then
+            echo "::error::Could not resolve the manifest digest for ${IMAGE_REF}:${IMAGE_VERSION} — signing aborted."
+            exit 1
+          fi
+          echo "Signing ${IMAGE_REF}@${digest}"
+          cosign sign --yes "${IMAGE_REF}@${digest}"
+          echo "::notice::Image index signed (keyless): ${IMAGE_REF}@${digest}. Verify with cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github.com/${{ github.repository }}/' ${IMAGE_REF}@${digest}"
+
       # v1.4.15: trigger the Coolify deploy automatically once GHCR has
       # the new image. Replaces the former manual SSH + force-pull recipe
       # on the deployment host.