Point-and-shoot ZAP CLI: deterministic Automation Framework runs against a digest-pinned OWASP ZAP image, stable artifact contract, stable exit codes.