You spend Tuesday afternoon running a vulnerability scan against your app’s container image. Zero critical CVEs, two mediums with patches already queued up. You feel good enough about it to merge the PR and let the pipeline ship it to production. Thursday morning, someone on the platform team …