A pre-audit check found rotated AWS keys buried in a Docker layer, revealing root containers, a dangerous socket mount, and real fixes that matter.