High-level ECR Repository builder following AWS best practices. **Default Security Settings:** - Image scan on push = enabled (security best practice) - Image tag mutability = MUTABLE (allows tag reuse for development) - Lifecycle policy = delete untagged images after 7 days - Encryption = AES256 (AWS managed encryption) - Removal policy = RETAIN (prevents accidental deletion) **Rationale:** These defaults follow AWS Well-Architected Framework: - Image scanning detects vulnerabilities automatically - Lifecycle policies reduce storage costs - Encryption at rest protects container images - RETAIN policy prevents accidental data loss **Escape Hatch:** Access the underlying CDK Repository via the `Repository` property for advanced scenarios not covered by this builder.