Enforce ON DELETE RESTRICT on images.registry_id so deleting a container registry that still has images is blocked at the database level instead of leaving dangling references that surfaced later as a misleading "Image not found in database" error.