Design a secure container build and deployment pipeline for a regulated industry (e.g., fintech or healthcare) with strict compliance requirements.

Cover: signed and verified images (image signing/attestation) to ensure only verified artifacts are deployed; mandatory vulnerability scanning with no override path for critical CVEs; non-root, minimal/distroless runtime images; secrets management via a dedicated vault/secrets manager rather than environment variables; full audit trail from commit to deployed artifact (traceable via immutable SHA-based tagging); network policies restricting which services can communicate with which; and encrypted data at rest and in transit throughout, with these controls enforced as automated pipeline gates r