The compliance scanner ships inside the golden image

Every endpoint-management product has the same first step: install the agent on every machine, keep it installed, notice when it's gone.

IT registers the scanner once, in the golden container, as a daemon program with autorestart on. It runs a file-integrity check every hour and POSTs a notification with urgency critical when a watched path changes. The daemon config is part of the container's filesystem, so every environment copied from golden starts with the scanner already registered, and the daemon manager brings it up. If it crashes, the daemon manager respawns it. Its status and its stderr are URLs IT can poll without touching the container.

Three hundred copies, three hundred scanners, zero install steps. Idle, the scanner costs nothing beyond the flat-rate box it shares. IT's notification display shows a grid of three hundred, quiet until one isn't.