Lessons from 200 SAST triages on false positives, operational risk, scan scope, pull-request gating, and what static analysis misses.