15. Best practices

Recommended cadence for PR gates, nightly scans, release archives, suppressions, and credentials.