Mirror thin bundle milestone-0 SAMPLE - Purpose: placeholder artefact for contracts/tests until real thin bundle lands. - Contents: manifest.json only (no advisories/images/policies). - Created: 2025-11-19T00:00:00Z - Deterministic tar created with fixed mtime/owners.