feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/homepage/configmap.yaml

@@ -43,6 +43,13 @@ data:
             href: https://grafana.${BASE_DOMAIN}
             description: Metrics, logs & dashboards (fronts Prometheus/Loki/Alertmanager)
             icon: mdi-chart-areaspline
+        # The CVE page (platform/vuln-scanner, docs/17): behind SSO, restricted to platform-admins.
+        # Homepage has no per-group surfaces, so this tile is shown to everyone who can open this
+        # dashboard; the page itself enforces platform-admins.
+        - CVE Report:
+            href: https://cve.${BASE_DOMAIN}
+            description: Container image CVE inventory (platform-admins)
+            icon: mdi-shield-bug
         - Semaphore:
             href: https://semaphore.${BASE_DOMAIN}
             description: Ansible automation & CI