The moment an artifact enters a private registry, risk tends to freeze. Repo owns a light ingest gate; cross-repo Findings and deep SCA stay with AngusSecurity.