Document: Container Image Provenance Buyer Pack

Container provenance needs one buyer pack before procurement asks which artifact shipped: digest, SBOM, attestation, scan owner, deploy gate, secret boundary, health check, rollback command, and proof