feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/requirements/registry.yaml

@@ -135,6 +135,44 @@ requirements:
     safety_critical: false
     summary: "Update policy per-service configurable (cadence, channel, pinning)."
 
+  # --- Vulnerability visibility ---
+  - id: R-VULN-01
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Inventory every running container image by digest with its workloads, from the cluster."
+  - id: R-VULN-02
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Every running image evaluated against a current database at least every 24h; new images within 2h."
+  - id: R-VULN-03
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Any target not evaluated is visibly reported with its reason; absence is never shown as clean."
+  - id: R-VULN-04
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Authenticated page lists every CVE with affected images, containers and workloads; searchable and filterable."
+  - id: R-VULN-05
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Inventory, scanning, reporting and triage run on a schedule with no human or AI action; loud failure."
+  - id: R-VULN-06
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Scan failure, staleness and unaccepted CRITICAL fixes reported by email as grouped alerts."
+  - id: R-VULN-07
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Scheduled bot keeps one dashboard issue and requests remediation via Renovate; no CVE detail exposed."
+  - id: R-VULN-08
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Accepted risk declared in git with reason and mandatory expiry; reverts to open on expiry."
+  - id: R-VULN-09
+    doc: docs/17-vulnerability-visibility.md
+    safety_critical: false
+    summary: "Scanner digest-pinned, no auto-merged updates, no Secret read or write access, no git credential."
+
   # --- Observability & alerting ---
   - id: R-OBS-01
     doc: docs/10-observability-and-alerting.md