* v1.91.27.0 fix(cso): package-level signed SBOMs and staged probes in the verifier container * Qualified scanner catalogs persist scan outcomes; catalog-state tests hold for either state; SBOM tests live with their owner