Container images are now part of every release path, but many teams still rely on public registries and ad-hoc credential handling. That creates avoidable risk: image provenance becomes unclear, pull-...