A platform team is designing the security strategy for a new set of microservice repositories. Leadership wants to minimize the number of vulnerabilities and leaked secrets that ever reach the default branch, rather than relying on catching problems during a final pre-release review. As the security architect, which approach best reflects a prevention-first strategy using the GitHub security suites?