feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

clusters/dev/kustomization.yaml

@@ -140,6 +140,21 @@ patches:
           provider: sops
           secretRef:
             name: sops-age
+  # vuln-scanner (the CVE visibility scanner, clusters/base/vuln-scanner.yaml) carries
+  # platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml — the per-pod oauth2-proxy
+  # client and cookie secrets. Without this stanza the Secret applies full of ENC[...] and the
+  # sidecar cannot authenticate; the rest of the scanner runs regardless. `sops-age` is out-of-band.
+  - patch: |-
+      apiVersion: kustomize.toolkit.fluxcd.io/v1
+      kind: Kustomization
+      metadata:
+        name: vuln-scanner
+        namespace: flux-system
+      spec:
+        decryption:
+          provider: sops
+          secretRef:
+            name: sops-age
   # cloudflared (the Cloudflare Tunnel connector, clusters/base/cloudflared.yaml) carries
   # platform/cloudflared/cloudflared-credentials.sops.yaml — the tunnel credentials JSON, the one
   # secret in that component. Without this stanza the Secret applies full of ENC[...]: the APPLY