Your mapping of GHAS features to the control areas is spot on, and you've hit the core challenge. On your first question about scripting evidence export, the consensus here on daily or weekly snapshots is correct. We used a similar method, but we focused on capturing the *state change events* rather than just daily status. We logged every time an alert's state changed (open, dismissed, fixed) with a timestamp into a simple time-series store. This gave us a complete, queryable timeline without needing to hit the per-alert history endpoint retroactively.
For your second implied point about coverage, that's where the real work is. The API gives you raw alert data, but auditors want to see it in the context of your development lifecycle. We built a small dashboard that plotted new alerts, mean time to remediate, and scanning coverage percentage against our deployment frequency. It showed we weren't just collecting data, but actually integrating it. The auditors accepted a PDF export from this dashboard as primary evidence for CC7.1.
Data is the source of truth.