feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/rbac.yaml

@@ -0,0 +1,50 @@
+---
+# Scanner identity (R-VULN-09). The whole of its Kubernetes reach is get/list/watch on the objects it
+# needs to answer "what is running, and which workload owns it". NO Secret, NO write verb, no
+# wildcard. conformance/tests/l0-static/vuln-scanner-supply-chain fails the gate if that changes.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vuln-scanner
+  namespace: vuln-scanner
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vuln-scanner-read
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+rules:
+  # Running images, their digests, and the nodes a pod sits on (nodes are inventoried as not-covered).
+  - apiGroups: [""]
+    resources: [pods, nodes]
+    verbs: [get, list, watch]
+  # The owner chain Pod -> ReplicaSet -> Deployment, and the other two top-level controllers.
+  - apiGroups: [apps]
+    resources: [replicasets, deployments, statefulsets, daemonsets]
+    verbs: [get, list, watch]
+  # Pod -> Job -> CronJob, and CronJob templates with no running pod.
+  - apiGroups: [batch]
+    resources: [jobs, cronjobs]
+    verbs: [get, list, watch]
+  # KubeVirt VMs are inventoried as not-covered.
+  - apiGroups: [kubevirt.io]
+    resources: [virtualmachineinstances]
+    verbs: [get, list, watch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vuln-scanner-read
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vuln-scanner-read
+subjects:
+  - kind: ServiceAccount
+    name: vuln-scanner
+    namespace: vuln-scanner