0009 amendment — public API on oci.thepeoples.io + mandatory signing

This amendment requires cosign on public OCI tags and keeps the public registry face on oci.thepeoples.io. Private broker and runner details are omitted.