feat(vuln): scanner service and fixture-driven L1 tests

Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner,
persisted state, schema-validated report.json, strict acceptances parser,
server-rendered page, aggregate metrics, internal API, and a scan loop
that stays live while scanning.

L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the
actual modules against recorded fixtures with a fake Trivy runner.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l1-rendering/vuln-scanner-scan-loop/check.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Runs the fixture-driven assertions in check.py. See chainsaw-test.yaml for the requirement tags.
+# What this does NOT prove: anything at runtime (real Trivy, real API, real browser). L2/L3 cover that.
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+export PYTHONDONTWRITEBYTECODE=1
+exec python3 "${HERE}/check.py"