You must guarantee that a specific tag can never be overwritten or deleted once published. Which ACR capability enforces this?

1. A Content Trust
2. B Repository-scoped tokens
3. ✓ C Tag locking via az acr repository update --write-enabled false (correct answer)
4. D Retention policy

Shortcut: Setting write-enabled/delete-enabled to false on a tag or repository makes it immutable. Content Trust proves authorship but does not prevent overwriting; retention policies delete rather than protect.