Shift-Left Meets Shift-Node: Moving Container Supply Chain Verification to Runtime via NRI

We have spent the last half-decade obsessing over "shifting left." We scan our Git repositories, run container image scanners in CI/CD pipelines, sign our artifacts with Cosign, and deploy admission controllers like Kyverno or OPA Gatekeeper to block…