A private container repository contains images used in production. The release process must evaluate known package vulnerabilities without assuming a pushed image is automatically safe. Which approach fits?

1. Use only a tag named patched regardless of its image content.
2. Treat a successful push as proof that no vulnerabilities exist.
3. Use supported image vulnerability scanning and a governed release decision based on relevant findings and artifact identity.
4. Delete vulnerability findings before release to make the report clean.