Add documentation explaining why to use Conforma instead of cosign directly

[st3penta]

The project lacks a document explaining the value proposition of using Conforma (EC) versus using cosign directly for verification. While ec validate image docs mention that certain stages are "akin to cosign verify" and "cosign verify-attestation", there is no high-level explanation of what Conforma adds on top of cosign.

A new documentation page (e.g., "Why Conforma?" or similar) should cover:

1. Policy-as-code evaluation -- Conforma layers Rego/OPA policy evaluation over signature and attestation verification, enabling organizational compliance rules that cosign alone cannot express
2. Batch and snapshot validation -- validating multiple images from an ApplicationSnapshot in a single invocation
3. Structured output and reporting -- multiple output formats (JSON, YAML, JUnit, summary, VSA) for CI/CD integration and audit trails
4. EnterpriseContractPolicy CRD integration -- declarative policy configuration via Kubernetes custom resources
5. Tekton task integration -- ready-made pipeline tasks for CI/CD workflows
6. Built-in rule library -- curated policy rules for SLSA provenance, build tasks, and release readiness

This page should be linked from the main navigation and the index page.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 10:18 AM UTC · Completed 10:20 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Category: Documentation · Severity: Low

This is a well-scoped documentation request. The issue clearly identifies a gap — no page explaining Conforma's value proposition over using cosign directly — and provides a concrete outline of six topics to cover.

Recommended Approach

Create a new documentation page covering:

1. Policy-as-code evaluation (Rego/OPA layer over signature verification)
2. Batch and snapshot validation (ApplicationSnapshot support)
3. Structured output and reporting (JSON, YAML, JUnit, summary, VSA)
4. EnterpriseContractPolicy CRD integration
5. Tekton task integration
6. Built-in rule library

Link the page from main navigation and the index page.

Proposed Verification

- Confirm the new page renders correctly and is reachable from navigation and index
- Verify all six topics are covered with accurate technical details
- Cross-check claims (e.g., supported output formats) against current codebase

The existing documentation and good first issue labels are appropriate — this is a self-contained writing task with clear requirements that a new contributor could tackle.

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 10:22 AM UTC · Completed 10:25 AM UTC
Commit: 47d3320 · View workflow run →