Complete procedures with a way back.

Operate a protected GitLab Runner 19.x on a dedicated host with nonprivileged Docker jobs, digest-pinned image admission, trust-isolated cache, explicit tags, adversarial tests, safe cleanup, and rebuild-first recovery.

Release OCI images from protected source through a disposable digest-pinned BuildKit builder, native SPDX and SLSA provenance, optional CycloneDX inventory, Cosign keyless or KMS signing, exact identity verification, digest-only admission, and evidence-backed recovery.