feat(vuln): scanner service and fixture-driven L1 tests

Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner,
persisted state, schema-validated report.json, strict acceptances parser,
server-rendered page, aggregate metrics, internal API, and a scan loop
that stays live while scanning.

L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the
actual modules against recorded fixtures with a fake Trivy runner.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l1-rendering/vuln-scanner-scan-loop/fixtures/trivy-empty.json

@@ -0,0 +1,4 @@
+{
+ "ArtifactName": "x",
+ "SchemaVersion": 2
+}