fix(verify): stage-gate after sign + guard :latest (v4.0.2)

Andrew Dunnrequested to merge
fix/v4-verify-ordering into main

verify raced ahead of the separate container-sign job (needs: build only) -> 'no signatures found'. Stage-gate verify (drop needs) so it runs after build+sign and inherits digests from dotenv; guard the :latest check (gated off MR). Cuts v4.0.2; consumers re-point @v4.0.2.

Merge request reports