feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/httproute.yaml

@@ -0,0 +1,34 @@
+---
+# The CVE page at cve.<domain>. Internal exposure only (docs/17 "Access"): a list of what is exploitable
+# where is sensitive, so this hostname publishes NO public DNS record (the `controller: none` annotation
+# below disowns it from external-dns) and the Cloudflare Tunnel 404s it (platform/cloudflared/config.yaml).
+# It resolves on the LAN through PiHole's explicit list (catalog/pihole.yaml).
+#
+# The backend is the `vuln-scanner` Service's `http` port, which fronts the oauth2-proxy sidecar, so the
+# SSO gate is in the data path; nothing routes to the page (:8080) directly.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vuln-scanner
+  namespace: vuln-scanner
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+  annotations:
+    homelab.keithjackson.dev/auth-mode: oauth2-proxy
+    homelab.keithjackson.dev/auth-groups: platform-admins
+    external-dns.alpha.kubernetes.io/controller: "none"
+spec:
+  parentRefs:
+    - name: shared
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - cve.${BASE_DOMAIN}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: vuln-scanner
+          port: 4180