Scan, Inventory, and Prove an Image

A credential reached a published image. Find it with a scanner, ship a clean rebuild that never contained it, and leave behind an SBOM and a provenance record that name the exact digest.