feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/kustomization.yaml

@@ -0,0 +1,50 @@
+---
+# The CVE visibility scanner (docs/17, ADR-0027). Reconciled by its OWN non-gating Flux Kustomization
+# (clusters/base/vuln-scanner.yaml: dependsOn platform-config, wait:false). A scanner that is failing,
+# or a pod that cannot get its report store, is a thing to alert on, never a thing that stalls the
+# platform. NOT a line in platform/kustomization.yaml.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Required for the configMapGenerator (see platform/cloudflared/kustomization.yaml).
+namespace: vuln-scanner
+resources:
+  - namespace.yaml
+  - rbac.yaml
+  - pvc.yaml
+  # The per-pod oauth2-proxy credential. SOPS-encrypted, decrypted per-env by the vuln-scanner
+  # Kustomization (both overlays patch it). Referenced by name only (R-IDP-04). Its template sibling
+  # is deliberately not named here (no-plaintext-secrets).
+  - vuln-scanner-oauth2-proxy-credentials.sops.yaml
+  - deployment.yaml
+  - service.yaml
+  # Namespace default-deny, the three ingress paths and the egress allowances. One file, so a baseline
+  # without its allows cannot ship alone and empty the TSDB.
+  - networkpolicy.yaml
+  - httproute.yaml
+  - servicemonitor.yaml
+  - alerts.yaml
+
+# Scanner source and the risk-acceptance file, both as content-hashed ConfigMaps, so a change rolls
+# the pod. No `disableNameSuffixHash`: the hash is the rollout mechanism.
+configMapGenerator:
+  - name: vuln-scanner-src
+    files:
+      - src/main.py
+      - src/inventory.py
+      - src/trivy.py
+      - src/state.py
+      - src/report.py
+      - src/acceptances.py
+      - src/page.py
+      - src/metrics.py
+      - src/server.py
+      - src/report.schema.json
+    options:
+      labels:
+        app.kubernetes.io/name: vuln-scanner
+  - name: vuln-scanner-acceptances
+    files:
+      - acceptances.yaml
+    options:
+      labels:
+        app.kubernetes.io/name: vuln-scanner