fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line

Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
  that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
  scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
  repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
  report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
  it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.

The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/src/server.py

@@ -126,7 +126,9 @@ def validate_triage(document):
         if entry["state"] not in REMEDIATION_STATES:
             return [prefix + "unknown state"]
         url = entry["url"]
-        if url is not None and (not isinstance(url, str) or len(url) > 2048 or trivy.safe_url(url) != url):
+        # safe_url is the same rule the report schema enforces, so a value accepted here cannot make
+        # the report invalid. Empty is refused: safe_url returns "" for it, and the schema does not.
+        if url is not None and (not isinstance(url, str) or not url or trivy.safe_url(url) != url):
             return [prefix + "url must be null or an http(s) URL"]
         if parse_ts(entry["updatedAt"]) is None or len(entry["updatedAt"]) > 64:
             return [prefix + "updatedAt must be RFC 3339"]