Stop Unsigned Containers on AKS with Kyverno and Cosign

Admission-time Kyverno on AKS: ACR allowlist, deny :latest, verify digests with key-based cosign. Production pilot — then torn down.