feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l2-behavioral/vuln-internal-api-isolated/chainsaw-test.yaml

@@ -0,0 +1,35 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — the internal API is unreachable from an unrelated namespace  (R-VULN-09)
+# Catalog: docs/17 "Acceptance gates" (L2).
+#
+# A pod in an unrelated namespace cannot reach vuln-scanner :8081 or :9090, while the CI runner identity can reach :8081.
+#
+# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
+# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: vuln-internal-api-isolated
+  labels:
+    conformance.home.k3s/R-VULN-09: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-VULN-09"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      A pod in an unrelated namespace cannot reach vuln-scanner :8081 or :9090, while the CI runner identity can reach :8081.
+spec:
+  steps:
+    - name: given-an-unrelated-namespace
+      try:
+        - script:
+            content: 'echo "TODO: create a throwaway namespace and probe pod"'
+    - name: when-connecting
+      try:
+        - script:
+            content: 'echo "TODO: attempt tcp to vuln-scanner:8081 and :9090"'
+    - name: then-denied
+      try:
+        - script:
+            content: 'echo "TODO: assert a timeout on both, and success from the act-runner identity on :8081"'

conformance/tests/l2-behavioral/vuln-new-digest-reported/chainsaw-test.yaml

@@ -0,0 +1,36 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — new workload digest appears in the report  (R-VULN-01, R-VULN-02)
+# Catalog: docs/17 "Acceptance gates" (L2).
+#
+# A newly started workload's digest appears in report.json, mapped to that workload, within the 2-hour window.
+#
+# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
+# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: vuln-new-digest-reported
+  labels:
+    conformance.home.k3s/R-VULN-01: "true"
+    conformance.home.k3s/R-VULN-02: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-VULN-01, R-VULN-02"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      A newly started workload's digest appears in report.json, mapped to that workload, within the 2-hour window.
+spec:
+  steps:
+    - name: given-a-new-workload
+      try:
+        - script:
+            content: 'echo "TODO: start a pod from an image digest not yet in the report"'
+    - name: when-the-scanner-ticks
+      try:
+        - script:
+            content: 'echo "TODO: wait, bounded by the 2h SLO, polling GET /report.json from the CI runner identity"'
+    - name: then-digest-is-reported
+      try:
+        - script:
+            content: 'echo "TODO: assert a target with that digest and the workload mapping, state not pending past 2h"'

conformance/tests/l2-behavioral/vuln-page-requires-admin/chainsaw-test.yaml

@@ -0,0 +1,39 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — the CVE page requires a platform-admins login  (R-VULN-04)
+# Catalog: docs/17 "Acceptance gates" (L2).
+#
+# An unauthenticated request to cve.<domain> is redirected to Keycloak, and a logged-in user outside platform-admins gets 403.
+#
+# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
+# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: vuln-page-requires-admin
+  labels:
+    conformance.home.k3s/R-VULN-04: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-VULN-04"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      An unauthenticated request to cve.<domain> is redirected to Keycloak, and a logged-in user outside platform-admins gets 403.
+spec:
+  steps:
+    - name: given-the-page-route
+      try:
+        - script:
+            content: 'echo "TODO: resolve cve.<domain> through the Gateway"'
+    - name: when-unauthenticated
+      try:
+        - script:
+            content: 'echo "TODO: request the page with no session"'
+    - name: then-redirected-to-keycloak
+      try:
+        - script:
+            content: 'echo "TODO: assert a 302 to the homelab realm"'
+    - name: then-non-admin-forbidden
+      try:
+        - script:
+            content: 'echo "TODO: assert 403 for a session outside platform-admins"'