Container images, not source code, are what ships to production. Here's why Docker made images the real supply chain trust boundary.