The scope is set explicitly in the `push_image` transform. We should try and move to `trust-domain-scopes` if possible.