A team wants to detect risky Kubernetes manifest settings, such as privileged containers, before merging changes. Which control best fits this stage?

1. Delete all Pod logs before the build starts
2. Run a Kubernetes manifest static-analysis tool in CI and review its findings
3. Base64-encode the manifest so reviewers cannot read it
4. Wait only for a runtime CPU alert