feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/service.yaml

@@ -0,0 +1,33 @@
+---
+# One Service, three named ports (the page gate, the internal API and metrics).
+#
+# clusterIP IS PINNED ON PURPOSE (10.43.210.10, verified unused against the live Service list on
+# 2026-11-09, inside k3s' default 10.43.0.0/16 Service CIDR). The triage bot runs as a Gitea Actions
+# job inside the runner's DinD daemon, and whether in-cluster DNS resolves from a DinD job container
+# is UNVERIFIED. The pinned address is the bot's fallback when the Service name does not resolve:
+# `http://10.43.210.10:8081` (VULN_API_FALLBACK_URL in .gitea/workflows/cve-triage.yaml).
+apiVersion: v1
+kind: Service
+metadata:
+  name: vuln-scanner
+  namespace: vuln-scanner
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+spec:
+  type: ClusterIP
+  clusterIP: 10.43.210.10
+  selector:
+    app.kubernetes.io/name: vuln-scanner
+  ports:
+    - name: http
+      port: 4180
+      targetPort: http
+      protocol: TCP
+    - name: internal
+      port: 8081
+      targetPort: internal
+      protocol: TCP
+    - name: metrics
+      port: 9090
+      targetPort: metrics
+      protocol: TCP