fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line

Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
  that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
  scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
  repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
  report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
  it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.

The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/src/acceptances.py

@@ -15,6 +15,7 @@ from datetime import date, timedelta
 from state import utcnow
 
 MAX_DAYS = 180
+MAX_REASON = 2048  # report.schema.json's limit; a longer reason would make the whole report invalid
 _KEYS = ("id", "image", "reason", "expires")
 _ENTRY = re.compile(r"^- ([a-z]+):(?: (.*))?$")
 _FIELD = re.compile(r"^  ([a-z]+):(?: (.*))?$")
@@ -91,6 +92,8 @@ def _validate(fields, today):
         problems.append("id is missing or malformed")
     if not fields.get("reason"):
         problems.append("reason is mandatory")
+    elif len(fields["reason"]) > MAX_REASON:
+        problems.append("reason is longer than " + str(MAX_REASON) + " characters")
     if "image" in fields and not fields["image"]:
         problems.append("image is empty")
     expires = fields.get("expires") or ""