credential-required now comes from a declared registry list, because LAN egress
is excluded and the scanner could never receive a refusal from the private
registry. The egress list now names the Gateway and identity provider, which
the SSO sidecar needs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>