The container registry migration enqueuer is updated
to use the root namespace when checking the denylist
and plan.