feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml.example

@@ -0,0 +1,28 @@
+# =============================================================================
+# TEMPLATE, NOT APPLIED, NOT ENCRYPTED. The OIDC client and cookie secrets for the per-pod oauth2-proxy
+# sidecar gating the CVE page (deployment.yaml, container oauth2-proxy). The sidecar reads these three
+# keys by name only (R-IDP-04).
+#
+# The `client-secret` value MUST equal `vuln-scanner-client-secret` in
+# platform/keycloak/keycloak-realm-clients.sops.yaml (a cross-namespace mirror, like crafty). See
+# platform/vuln-scanner/README.md, "Operator step". Never decrypt this to a terminal or a log.
+#
+# Regenerate (encrypts to the repo's public recipient via .sops.yaml, values never echoed):
+#   ./infra/devcontainer/dev.sh run bash -c '
+#     cs=$(openssl rand -hex 32); ck=$(openssl rand -base64 32 | tr -- "+/" "-_")
+#     sops -e --input-type yaml --output-type yaml \
+#       --filename-override platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \
+#       /dev/stdin <<YAML > platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml
+#   ...this document with client-secret: $cs and cookie-secret: $ck...
+#   YAML'
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vuln-scanner-oauth2-proxy
+  namespace: vuln-scanner
+type: Opaque
+stringData:
+  client-id: vuln-scanner
+  client-secret: REPLACE-ME
+  cookie-secret: REPLACE-ME