Dependency scanning in the pipeline: CI pre-scan vs artifact-repo gates

Put SCA in CI, then push AngusRepo HOSTED. Separate CI feedback, Repo download gates, and AngusSecurity engines—with tiers, full snippets, alignment drills, and an acceptance checklist.