Companion to argus-appliance issue #88. update.sh no longer trusts the
version manifest alone -- before pulling or restarting any service, it
independently resolves each image's live registry digest and verifies it
matches what the release pipeline recorded, then cosign-verifies the
signature against the committed public key. Aborts (installation
untouched) on any mismatch, missing tool, or ambiguity.
