refactor: instance component uses supply-chain !reference Instance build/promote jobs now use !reference to supply-chain hidden jobs for cosign, syft, SBOM, and attestation. Eliminates inline duplication that caused the v1.0.3-v1.0.6 bug chain. Net -49 lines. Breaking: consumers MUST include supply-chain component alongside instance component for !reference resolution.