ADR-007: Docker Registry

Publishable summary of this architecture decision.

Decision

Use GHCR as the default organization registry and ECR only when a project has a concrete operational need.

• GHCR is the default for internal builds and distribution.
• ECR can be enabled per project for AWS-region pull needs.
• Tags should distinguish SHA builds and semantic releases.
• Deploy should use protected environments and dedicated workflows.