Ship security into the sprint

Annual audits surprise teams because findings never had an owner in the sprint. Treat security work like product work — sized, scheduled, and reviewed.