feat(vuln): scanner service and fixture-driven L1 tests

Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner,
persisted state, schema-validated report.json, strict acceptances parser,
server-rendered page, aggregate metrics, internal API, and a scan loop
that stays live while scanning.

L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the
actual modules against recorded fixtures with a fake Trivy runner.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l1-rendering/vuln-scanner-scan-loop/fixtures/cluster.json

@@ -0,0 +1,198 @@
+{
+ "cronjobs": [
+  {
+   "metadata": {
+    "name": "nightly",
+    "namespace": "ops"
+   },
+   "spec": {
+    "jobTemplate": {
+     "spec": {
+      "template": {
+       "spec": {
+        "containers": [
+         {
+          "image": "ghcr.io/org/nightly:2.1",
+          "name": "job"
+         }
+        ]
+       }
+      }
+     }
+    }
+   }
+  }
+ ],
+ "jobs": [],
+ "nodes": [
+  {
+   "metadata": {
+    "name": "prod-1"
+   }
+  }
+ ],
+ "pods": [
+  {
+   "metadata": {
+    "name": "web-1",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "ReplicaSet",
+      "name": "web-5f"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "nginx:1.27",
+      "name": "app"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "docker.io/library/nginx@sha256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+      "name": "app"
+     }
+    ],
+    "phase": "Running"
+   }
+  },
+  {
+   "metadata": {
+    "name": "api-1",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "ReplicaSet",
+      "name": "api-77"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "nginx:1.27",
+      "name": "server"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "docker.io/library/nginx@sha256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+      "name": "server"
+     }
+    ],
+    "phase": "Running"
+   }
+  },
+  {
+   "metadata": {
+    "name": "db-0",
+    "namespace": "data",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "StatefulSet",
+      "name": "db"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "postgres:16",
+      "name": "postgres"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "docker.io/library/postgres@sha256:d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4",
+      "name": "postgres"
+     }
+    ],
+    "phase": "Running"
+   }
+  },
+  {
+   "metadata": {
+    "name": "priv-1",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "ReplicaSet",
+      "name": "priv-1a"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "ghcr.io/org/private:1",
+      "name": "priv"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "ghcr.io/org/private@sha256:e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5",
+      "name": "priv"
+     }
+    ],
+    "phase": "Running"
+   }
+  }
+ ],
+ "replicasets": [
+  {
+   "metadata": {
+    "name": "web-5f",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "Deployment",
+      "name": "web"
+     }
+    ]
+   }
+  },
+  {
+   "metadata": {
+    "name": "api-77",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "Deployment",
+      "name": "api"
+     }
+    ]
+   }
+  },
+  {
+   "metadata": {
+    "name": "priv-1a",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "Deployment",
+      "name": "priv"
+     }
+    ]
+   }
+  }
+ ],
+ "vmis": []
+}