license switch agpl -> busl1, sprints work, new product advisories

devops/compose/docker-compose.cas.yaml

@@ -52,7 +52,7 @@ volumes:
 services:
   # Primary CAS storage - runtime facts, signals, replay artifacts
   rustfs-cas:
-    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
     command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
     restart: unless-stopped
     environment:
@@ -99,7 +99,7 @@ services:
 
   # Evidence storage - Merkle roots, hash chains, evidence bundles (immutable)
   rustfs-evidence:
-    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
     command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data", "--immutable"]
     restart: unless-stopped
     environment:
@@ -135,7 +135,7 @@ services:
 
   # Attestation storage - DSSE envelopes, in-toto attestations (immutable)
   rustfs-attestation:
-    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
     command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data", "--immutable"]
     restart: unless-stopped
     environment:
@@ -169,6 +169,24 @@ services:
       retries: 3
       start_period: 10s
 
+  rekor-cli:
+    image: ghcr.io/sigstore/rekor-cli:v1.4.3
+    entrypoint: ["rekor-cli"]
+    command: ["version"]
+    profiles: ["sigstore"]
+    networks:
+      - cas
+    labels: *release-labels
+
+  cosign:
+    image: ghcr.io/sigstore/cosign:v3.0.4
+    entrypoint: ["cosign"]
+    command: ["version"]
+    profiles: ["sigstore"]
+    networks:
+      - cas
+    labels: *release-labels
+
   # Lifecycle manager - enforces retention policies
   cas-lifecycle:
     image: registry.stella-ops.org/stellaops/cas-lifecycle:2025.10.0-edge
@@ -189,3 +207,4 @@ services:
     networks:
       - cas
     labels: *release-labels
+