feat(vuln): scanner service and fixture-driven L1 tests

Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner,
persisted state, schema-validated report.json, strict acceptances parser,
server-rendered page, aggregate metrics, internal API, and a scan loop
that stays live while scanning.

L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the
actual modules against recorded fixtures with a fake Trivy runner.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l1-rendering/vuln-scanner-scan-loop/fixtures/trivy-postgres.json

@@ -0,0 +1,25 @@
+{
+ "ArtifactName": "x",
+ "Results": [
+  {
+   "Target": "t",
+   "Vulnerabilities": [
+    {
+     "CVSS": {
+      "nvd": {
+       "V3Score": 7.5
+      }
+     },
+     "FixedVersion": "16.2",
+     "InstalledVersion": "1.0",
+     "PkgName": "libpq",
+     "PrimaryURL": "https://example.test/CVE-2026-0010",
+     "Severity": "HIGH",
+     "Title": "libpq flaw",
+     "VulnerabilityID": "CVE-2026-0010"
+    }
+   ]
+  }
+ ],
+ "SchemaVersion": 2
+}