Block the merge when a PR ships a vulnerability: a CI security gate with Synapse

I have a simple rule when I work with a team: if a vulnerability makes it into main , the process already failed somewhere upstream. The right place to catch it is on the pull request, before anyone c...