Engineering CRA, NIS2 and DORA into product security — translating regulatory mandates into runtime controls.