SSDF-to-Gates: Turning Security Practices into Pipeline Decisions

SSDF practices become operational in CI/CD only when they map to gates, evidence, and pass/fail criteria.