The role of artifact repos in SCA, image scanning, SBOM, ingest gates, and license compliance — and how that complements CI scanning.