[Knowledge] container-registry: ## Advisory Notes — Stage 1: Managed Identity - **[Architec...

## Knowledge Contribution

**Type:** Pitfall
**File:** `knowledge/services/container-registry.md`

### Context
## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permissions are over-scoped in later stages, every service inherits that exposure. Consider per-service identities for production least-privilege isolation.

- **[Security]** No resource lock is applied to the managed identity. Accidental deletion would orphan all downstream RBAC assignments and break ev

### Rationale
## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permissions are over-scoped in later stages, every service inherits that exposure. Consider per-service identities for production least-privilege isolation.

- **[Security]** No resource lock is applied to the managed identity. Accidental deletion would orphan all downstream RBAC assignments and break ev

### Content to Add
```
## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permi
```

### Source
Build advisory review

Open knowledge/services/container-registry.md and review the existing Stage 1: Managed Identity content. Add the advisory notes from the issue under the specified section, preserving the documented architectural trade-off and security caveats. Done means the file contains the complete contribution in the expected Markdown format.

Written by the indexing model from the issue text.