fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line

Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
  that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
  scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
  repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
  report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
  it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.

The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l1-rendering/vuln-scanner-api-metrics/check.py

@@ -150,6 +150,10 @@ with tempfile.TemporaryDirectory() as tmp:
         mutate(document)
         status, _, _ = post(internal, document)
         check("triage rejects " + name, status == 400)
+    for name, url in (("an uppercase scheme", "HTTP://gitea.test/pulls/1"), ("an empty url", ""), ("a javascript url", "javascript:alert(1)")):
+        bad = json.loads(json.dumps(valid))
+        bad["remediation"][0]["url"] = url
+        check("triage rejects " + name, post(internal, bad)[0] == 400)
     check("triage rejects a wrong content type", post(internal, valid, "text/plain")[0] == 415)
     status, _, _ = request(internal, "POST", "/triage", b"x" * 300000, {"Content-Type": "application/json"})
     check("triage rejects an oversized body", status == 413)