fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line

Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
  that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
  scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
  repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
  report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
  it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.

The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l1-rendering/vuln-scanner-acceptances/check.py

@@ -94,6 +94,15 @@ def status(when, accepted, errs=()):
     return built, built["findings"][0]
 
 
+def reason_entry(length):
+    return acceptances.parse_text("- id: CVE-1\n  reason: " + "r" * length + "\n  expires: 2026-12-01\n", NOW.date())
+
+
+found, problems = reason_entry(3000)
+check("a reason over 2048 characters ignores the entry and reports it", found == [] and any("2048" in p for p in problems))
+found, problems = reason_entry(2048)
+check("mutation: a reason of exactly 2048 characters is valid", len(found) == 1 and problems == [])
+
 entry = {"id": "CVE-1", "image": None, "reason": "not reachable", "expires": date(2026, 11, 9)}
 built, finding = status(NOW, [entry])
 check("unexpired acceptance marks the finding accepted", finding["status"] == "accepted"