How underground CCS works: low leakage risk, 2%