A team publishes private container images to Amazon ECR. Security requires managed scanning for software vulnerabilities and updated findings as vulnerability intelligence changes. Which option most directly provides this capability?

1. Enable GuardDuty and assume its account threat findings replace ECR image package scanning.
2. Enable only ECR image tag immutability.
3. Create a CloudTrail trail for ECR image pushes and treat each push event as a clean vulnerability assessment.
4. Enable Amazon Inspector enhanced scanning for the relevant ECR repositories with the appropriate continuous scanning settings.