feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests

Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and
python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>),
five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with
mutation self-tests. src/ and the bot workflow are integrated separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

renovate.json5

@@ -146,7 +146,9 @@
         "/(^|/)versions\\.env$/",
         "/(^|/)platform/pm-agent/.+\\.ya?ml$/",
         // ADDED 2026-11-08: the merge gate's job `container:` is the toolbox, by digest.
-        "/^\\.gitea/workflows/gate\\.ya?ml$/"
+        "/^\\.gitea/workflows/gate\\.ya?ml$/",
+        // ADDED 2026-11-09: the CVE triage bot's job `container:` is pinned by digest with the marker.
+        "/^\\.gitea/workflows/cve-triage\\.ya?ml$/"
       ],
       "matchStrings": [
         "#\\s*renovate-digest:\\s*image=(?<depName>\\S+)\\s+tag=(?<currentValue>\\S+)\\s*\\n[^\\n]*?(?<currentDigest>sha256:[a-f0-9]{64})"
@@ -277,7 +279,12 @@
         // never propose gitea/act_runner -> gitea/runner — so that migration is a manual PR. Listed
         // now so the new name is blast-radius from its first reference, not after an auto-merge.
         "gitea/runner",
-        "ghcr.io/cloudnative-pg/postgresql"
+        "ghcr.io/cloudnative-pg/postgresql",
+        // ADDED 2026-11-09 (R-VULN-09, ADR-0027). The CVE scanner reads every image in the cluster
+        // and Trivy's release pipeline was compromised in March 2026 (CVE-2026-33634), so it is
+        // blast-radius: a human reads the changelog. The 7-day minimum release age is the separate
+        // rule below; this entry is what keeps it out of auto-merge.
+        "ghcr.io/aquasecurity/trivy"
       ],
       "automerge": false,
       "addLabels": [
@@ -285,6 +292,20 @@
         "blast-radius"
       ]
     },
+    // ADDED 2026-11-09 — MINIMUM RELEASE AGE FOR THE CVE SCANNER (R-VULN-09, docs/17 "Security of the
+    // scanner itself"). An upstream release that later turns out to be compromised (as 0.69.4/5/6 were
+    // in March 2026) gets a week to be detected before Renovate will propose it. Applied to the
+    // image the scanner's Deployment pins, tracked by the `kubernetes` manager (platform/ is in its
+    // managerFilePatterns; the `tag@digest` form is what it updates), and matched here by package
+    // name. automerge:false again here so this rule cannot lose to a later one.
+    // The Renovate validator was NOT run on this addition: contract forbids running images locally.
+    {
+      "description": "CVE scanner image (Trivy): 7-day minimum release age, never auto-merged (R-VULN-09). A minimumReleaseAge the datasource cannot date holds the update back rather than letting it through.",
+      "matchPackageNames": ["ghcr.io/aquasecurity/trivy"],
+      "automerge": false,
+      "minimumReleaseAge": "7 days",
+      "addLabels": ["needs-review", "blast-radius"]
+    },
     // ADDED 2026-10-30 — THE KEYCLOAK OPERATOR IS THE KEYCLOAK VERSION. The operator, its CRDs
     // and the server image are released in lockstep from keycloak/keycloak-k8s-resources, and the
     // Keycloak CR carries no spec.image, so the operator's RELATED_IMAGE_KEYCLOAK picks the server