docs(patch-policy): cosign verify names a tag that exists — X.Y.Z, not vX.Y.Z

[MrChengLen]

What

docs/patch-policy.md → Signing & verification: the cosign verify example named the image tag vX.Y.Z. docker.yml tags release images via metadata-action type=semver,pattern={{version}} (and {{major}}.{{minor}}), which drops the Git tag's v: release v1.2.3 pushes 1.2.3, 1.2, 1.2.3-office and 1.2-office. The documented command therefore failed for every release. It now says X.Y.Z, like the filemorph:1.2.3 in docs/release-signing.md.

Live check against GHCR (anonymous registry API): filemorph:1.1.0 → 200, filemorph:v1.1.0 → 404. None of the 570 published tags starts with v.

Guard

• tests/test_supply_chain_hygiene.py::test_docs_name_no_v_prefixed_image_tag fails when a tracked top-level or docs/ Markdown file (CHANGELOG aside) names a filemorph:v… image tag, with or without the ghcr.io/mrchenglen/ prefix. It fails against the old text (naming docs/patch-policy.md:109) and passes after the fix.
• It matches any v, not only v<digit>: this bug used the placeholder vX.Y.Z, which a digit-only pattern would miss.
• With the docs fixed the guard never meets a hit, so test_v_image_tag_pattern_recognises_any_v_tag pins the pattern (same approach as test_privileged_recognises_secrets_in_any_form). Four narrowed or widened variants of the pattern each fail it.
• The git ls-files doc listing moves into _tracked_docs(), shared with the existing pip-audit docs guard, which behaves as before.
• Known limit: a DSN example with a password starting with v (postgresql://filemorph:v…@) would trip it. The docs mask that password as *** today.

Deliberately not changed

The --certificate-identity-regexp flags stay as they are. Pinning the identity to the tag build is separate work that has not landed yet; this PR touches only the tag, so the overlap with that work is one line.

Verification

• Full suite: 1488 passed, 72 skipped (local Windows run; WeasyPrint/pikepdf tests skip there)
• ruff check + ruff format --check: clean
• gitleaks on the staged diff, the pre-commit scope-guard and scripts/scope_review.py: clean
• commit-review gate: security-auditor PASS (no Critical/High/Medium); code-reviewer approve (no Critical/Warning). Two of its optional suggestions are applied: the pattern self-test and a more precise CHANGELOG sentence.

🤖 Generated with Claude Code