A security policy requires deployable images to be stored in a controlled repository with repository-level access permissions. Which approach best fits?

1. Use Cloud Build with reviewed build configuration.
2. Store images in Artifact Registry with scoped IAM.
3. Use Cloud Deploy delivery pipelines and targets.
4. Enforce Binary Authorization with the appropriate trusted attestations.