X_IMAGE_GUARD_MISSING
Means
the final stage of any Dockerfile in the tree declares an ENTRYPOINT that no RUN in that same stage executes
Typical cause
the guard sits in an earlier stage, or is absent. Proving the binary runs on the build image proves nothing about what ships, and the Dockerfile that shipped the libc mismatch above did carry a guard — in the wrong stage. A stage with no ENTRYPOINT has nothing to guard and is not reported
Fix
bun run scripts/image-contract.ts --json — the fix carries the exact RUN ["<entrypoint>", "--version"] to add to the final stage