Catch expiring TLS certs and weak security headers in CI — with one small CLI

Your CI proves the app builds, the tests pass, and maybe that there are no known-vulnerable dependencies. Then it ships — behind a TLS certificate that will quietly expire in three weeks, serving resp...