I am trying to create a cluster in a test environment/stack with Pulumi, but I am unable to assign the container registry permissions because my registry is in a different subscription. What is the best practice for Container registries re: different stacks? Do we have a container registry in each stack and then migrate an image between registries when moving to production? (When a build is approved for production I need to use the same exact image that was approved - I don't want to re-build the image. )