Help me choose a hardened container images provider, I'm tired of maintaining our own

Looked at Chainguard, Docker Hardened Images, Google Distroless, and Iron Bank. Here is what's putting me off each:

• Chainguard: version pinning and SLAs locked behind paid tier, free tier feels limited for prod use
• Docker Hardened Images: enterprise CVE remediation SLA needs a paid plan, not clear how fast they actually move on critical patches
• Google Distroless: no SBOM out of the box, no commercial SLA, catalog is pretty narrow

What I actually need from whichever I go with:

• Rebuilt promptly after upstream CVEs, not sitting vulnerable between release cycles
• Signed SBOMs I can hand to an auditor without getting involved iin it
• FIPS compatibility, we are in a regulated environment (this is important)
• Minimal footprint, no packages we will never use

Anyone running one of these in a regulated shop who can share what actually held up in production?