dunn.dev/pipeline 4.0.0 Breaking major (dead-surface removal + supply-chain hardening). Removed (zero-consumer, estate-wide verified): - cloudflare-pages component + recipes/validate slots (use cloudflare-worker) - release-create `extra_sbom_jobs` input + upload-extra-sbom job/recipe Supply chain: - ci image bakes osv-scanner + cosign (checksum-verified) → osv-verdict gate and node-publish signing install nothing at runtime - syft installer pinned to a release tag (was mutable main) - template tool-version defaults are Renovate-tracked (customManager) Lint: lint-includes (supersedes lint-suppression) — structural YAML bijection + suppression coverage. cosign/syft fallback defaults aligned to baked versions; go-sbom skips .sha256 sidecars. Merged via !96 (rebased onto current main; pipeline green incl. osv-verdict).