dgoss: Testing the Container, Not Just the Image

TL;DR Most Docker image “validation” happens either before the image exists (Dockerfile linting/build checks) or without running it (CVE/config scanning, image structure tests). That leaves a practical gap: asserting the built image behaves like the...