Signed releases and loopback binding

Signed releases

Every Docker image and Helm chart is now signed. The release workflow signs the xprem and expo-open-ota images and both Helm charts with cosign, using keyless Sigstore signatures tied to the GitHub Actions identity of the release workflow. Signatures are recorded in the public transparency log.

Verify a release before deploying it:

cosign verify ghcr.io/mercuretechnologies/xprem:v3.2.3 --certificate-identity-regexp '^https://github.com/mercuretechnologies/xprem/.github/workflows/release.yml@refs/tags/v' --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same command verifies the Helm chart with ghcr.io/mercuretechnologies/charts/xprem:3.2.3 as the reference.

Bind server to specific address

Bind the server to a specific address. The new BIND_TO_ADDRESS environment variable sets the interface the API server listens on. Set it to 127.0.0.1 to keep the server on the loopback interface behind a reverse proxy on the same host. The default stays 0.0.0.0, so existing deployments are unaffected. An invalid address is rejected at startup with a configuration error. Thanks to @nduitz for their first contribution.

Upgrading

No changes required. Signature verification is optional and does not affect how images or charts are pulled.