Rename the app version directory to match the primary image, remove the stale fixed version from the README, and document the official image scan risk.
Keep source-evidence.json as local workflow material by ignoring it repository-wide and remove previously committed evidence files from application trees.