docs: add checkpoint 16 on CI/CD security gates and deployment protection

[wendev27]

📚 Summary

Added Checkpoint 16 covering how modern DevSecOps teams enforce security policies and prevent vulnerable code from reaching production.

---

🎯 Topics Covered

• GitHub Actions workflows
• CI/CD security gates
• Branch protection rules
• Required status checks
• CodeQL integration
• Trivy integration
• Semgrep integration
• Deployment protection
• Secure production pipelines

---

🧠 Key Takeaway

Security scanners alone do not protect production systems.

Real protection comes from combining:

• Automated CI/CD pipelines
• Security scanning tools
• Branch protection rules
• Deployment restrictions

Together, these mechanisms prevent insecure code from being merged and deployed.

---

✅ Outcome

This checkpoint demonstrates how modern DevSecOps teams transform CI/CD pipelines into automated security gates.