feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/pvc.yaml

@@ -0,0 +1,19 @@
+---
+# The report store: state.json (firstSeenAt, failed-since, heartbeat, last complete run) and
+# report.json. 1Gi on the replicated tier is generous for two JSON files; it is DELIBERATELY NOT where
+# the vulnerability database or the per-image scan caches live, because etcd and Longhorn share a
+# partition on every node (docs/02, docs/17 "Load"). Those are on the size-limited /cache emptyDir.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vuln-scanner-data
+  namespace: vuln-scanner
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi