Executable image builds belong in the pre-deployment release gate
A release gate for a containerized service must execute the complete image build from the exact pinned base digest; static assertions about the Dockerfile, dependency lock, and runtime contract are necessary but do not prove that the pinned base's package-management policy still …