SAST getting started: principles, scenarios, and rollout steps

SAST primer: principles, when it fits, rule-driven detection, and rollout steps with copyable scan commands and gate ideas. Run a reproducible code security scan and know where false positives and rule tuning start.