Continuous scanning and guided remediation that keeps audits boring

Replaced annual pentests with continuous scanning, risk-scored findings, and a remediation workflow tied straight into engineering's sprint board.