Why is image scanning (e.g., Trivy, Grype) part of a secure CI/CD pipeline?

It automatically detects known CVEs in OS packages and application dependencies baked into an image before it's deployed, allowing a pipeline to block releases with critical vulnerabilities rather than discovering them only after the image is already running in production.