Software supply chain security is not one scanner. Learn how source control, CI runners, dependencies, artifacts, SBOMs, provenance, signing, and deployment policy fit together.