The SAST half is now required: require_semgrep exits 2 naming the tool before the
image pull; ETV_SCAN_SKIP_SEMGREP=1 stays the only skip. --selftest pins absent,
opt-out and present. docs/ci-cd.md states the invariant, not the stale host claim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1