40. CI/CD and software supply chain security

Build automated pipelines that compile, test, scan, package, sign, and release Spring Boot applications. Manage dependency updates, software bills of materials, artifact provenance, and vulnerability response.