feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/cloudflared/config.yaml

@@ -54,6 +54,10 @@ ingress:
   # tunnel alongside decision 4.
   - hostname: headlamp.${BASE_DOMAIN}
     service: http_status:404
+  # The CVE page (docs/17: internal only, a list of what is exploitable where). Its route is disowned
+  # from public DNS (platform/vuln-scanner/httproute.yaml); this is the second layer.
+  - hostname: cve.${BASE_DOMAIN}
+    service: http_status:404
   # Non-HTTP L4 VIPs (their own LoadBalancer addresses, not the Gateway). Listed so a DNS flip
   # that CNAMEs them at the tunnel by mistake gets a 404, not the Gateway's catch-all.
   - hostname: unifi.${BASE_DOMAIN}

platform/cloudflared/networkpolicy.yaml

@@ -147,3 +147,4 @@ spec:
                 - radarr
                 - sonarr
                 - headlamp
+                - vuln-scanner