Capture GitHub PR approvals, branch protection drift, and AI-assisted commits as continuous, tamper-evident evidence — mapped to SOC 2 CC8.1, ISO 27001 A.8.32, and EU AI Act requirements.