People like to discuss software supply chain security as if it were a clean engineering problem with a clean engineering answer. It is not. In real companies, releases are pushed under deadline pressure, credentials are shared more often than anyone admits, legacy tooling survives far longer than planned, and third-party dependencies quietly pile...