the just-in-time depth part is what sticks for me. but the sonarqube story kinda shows the catch, you only dug in because CI flagged it, so what's the trigger when nothing flags it and the agent's code just quietly rots?