Capability-scoped reports: SAST, deps, images, secrets, licenses

A full-capability report is too thick: engineers want code paths, supply-chain wants CVEs, compliance wants license exceptions—do not invent five unrelated exporters. Narrow filters on the same report