feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/servicemonitor.yaml

@@ -0,0 +1,20 @@
+---
+# Prometheus scrape of the aggregate-only /metrics (:9090). Only the `metrics` port of the shared
+# Service; networkpolicy.yaml admits only Prometheus on it. kube-prometheus-stack selects
+# ServiceMonitors from any namespace; the `release` label is kept for consistency.
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: vuln-scanner
+  namespace: vuln-scanner
+  labels:
+    app.kubernetes.io/name: vuln-scanner
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vuln-scanner
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 60s