Capability-scoped reports: SAST, deps, images, secrets, licenses

A full-capability report is too thick: engineers want code paths, supply-chain wants CVEs, compliance...