2.3.0 Major catalog uplift for the dunn.dev estate supply chain: - node-* templates (node-build, node-audit, node-publish, node-sbom) bring npm packages to parity with Go binaries: signed releases via cosign sign-blob of the tarball, CycloneDX SBOM, npm publish to GitLab project registry. - container-sbom template: CycloneDX SBOM for built container images via syft scanning the pushed registry image. - container-image: new publish_at_root mode for estate-shared images (e.g. dunn.dev/caddy-estate) that publish at the registry repo root instead of an image_tag sub-path. - ci-runtime-node: new UBI 9 nodejs-22-minimal runtime base for Node SSR consumers. Pairs with container-image (from_artifacts: true). - ci-rust: Zig 0.15.x URL naming fix (arch order changed upstream).