Evidence incomplete: Container images are not all digest-pinned; The provider-declared image digest is not cryptographically bound to the workload quote