Gated promotion

Moving an artifact from one environment to the next is checked against policy. Only signed, scanned builds move forward. Key points:

• Promotion is a gate, not a copy: an artifact that is unsigned or unscanned does not advance.
• This closes the gap between "it passed once" and "the thing we are promoting is that same checked artifact."