Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="pkg/detection/deploytime/detector_impl.go" line_range="21-26" />
<code_context>

 // Detect runs detection on a deployment, returning any generated alerts.
-func (d *detectorImpl) Detect(goctx context.Context, ctx DetectionContext, enhancedDeployment booleanpolicy.EnhancedDeployment, filters ...detection.FilterOption) ([]*storage.Alert, error) {
+func (d *detectorImpl) Detect(ctx context.Context, enhancedDeployment booleanpolicy.EnhancedDeployment, opts ...DetectOption) ([]*storage.Alert, error) {
+	var cfg detectionConfig
+	for _, o := range opts {
+		o(&cfg)
+	}
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Guard against nil DetectOptions to avoid potential panics when options are built dynamically

With the variadic `DetectOption` signature, callers can easily pass `nil` (e.g., from conditional appends), which would cause a panic when invoked. Please update the loop to skip nil options:

```go
for _, o := range opts {
    if o == nil {
        continue
    }
    o(&cfg)
}
```

```suggestion
 // Detect runs detection on a deployment, returning any generated alerts.
func (d *detectorImpl) Detect(ctx context.Context, enhancedDeployment booleanpolicy.EnhancedDeployment, opts ...DetectOption) ([]*storage.Alert, error) {
	var cfg detectionConfig
	for _, o := range opts {
		if o == nil {
			continue
		}
		o(&cfg)
	}
```
</issue_to_address>

### Comment 2
<location path="central/detection/deploytime/default_policies_bench_test.go" line_range="34" />
<code_context>

 	for b.Loop() {
-		_, err := detection.Detect(context.Background(), deploytime.DetectionContext{}, booleanpolicy.EnhancedDeployment{
+		_, err := detection.Detect(context.Background(), booleanpolicy.EnhancedDeployment{
 			Deployment: dep,
 			Images:     images,
</code_context>
<issue_to_address>
**issue (testing):** Add focused unit tests for the new deploytime.Detect options API (enforcement-only and policy filters).

The benchmark now uses the new `Detect` signature, but there are no unit tests that cover `DetectOption` behavior (`WithEnforcementOnly`, `WithPolicyFilters`) or confirm parity with the old `DetectionContext` + filters. Please add tests in the deploytime detection package (and/or central detector) that:

- Confirm `WithEnforcementOnly()` suppresses alerts for `UNSET_ENFORCEMENT` policies while the default (no option) still emits them, matching previous `EnforcementOnly=false` behavior.
- Validate `WithPolicyFilters()` applies all filters correctly, including order and short-circuit behavior.
- Verify central and sensor callers (admission-control, unified detector, etc.) still produce the same alerts as before, particularly for enforcement-only flows.

This will ensure the new options-based API is properly covered and that detection semantics remain unchanged by the refactor.
</issue_to_address>

### Comment 3
<location path="pkg/detection/deploytime/detector.go" line_range="37" />
<code_context>
 	PolicySet() detection.PolicySet

-	Detect(goctx context.Context, ctx DetectionContext, enhancedDeployment booleanpolicy.EnhancedDeployment, policyFilters ...detection.FilterOption) ([]*storage.Alert, error)
+	Detect(ctx context.Context, enhancedDeployment booleanpolicy.EnhancedDeployment, opts ...DetectOption) ([]*storage.Alert, error)
 }

</code_context>
<issue_to_address>
**issue (complexity):** Consider simplifying the new Detect API changes by minimizing configuration surface and keeping the function signature straightforward.
</issue_to_address>