How to block vulnerable and non-compliant artifacts at admission

Upload is not scanned. Link AngusSecurity for SCA engines, keep Repo policies and “refuse download on fail,” with integration steps, capability matrix, gray rollout, and a failure table.