Short answer: an SBOM attestation records component inventory associated with an image build. It improves review and traceability, but it is not proof that the image is vulnerability-free, trustworthy, or safe at runtime.
How should you separate the artifacts?
An SBOM describes components. Provenance describes how an artifact was built. A signature helps verify integrity and signer identity. A scanner reports findings against a database. Runtime controls limit what the deployed workload can do. These layers answer different questions.
What is the small-team workflow?
Tie the image to a reviewed source revision, retain its immutable digest, generate or retrieve the SBOM attestation, inspect provenance, review important findings, and record the deployment decision. Connect that record to your Compose inventory and recovery notes.
Start with SBOM and image provenance and Docker signing.