fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line

Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
  that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
  scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
  repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
  report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
  it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.

The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/src/state.py

@@ -72,6 +72,9 @@ def new_state():
         "remediation": [],
         "triageHeartbeatAt": None,
         "loadError": None,
+        # The scan key Trivy is running against right now, persisted BEFORE the scan starts: an OOM
+        # kill takes the whole container, so nothing can record the failure afterwards.
+        "inFlight": None,
     }
 
 
@@ -84,6 +87,7 @@ def new_record(now):
         "outcome": None,
         "reason": None,
         "failedSince": None,
+        "killedAt": None,
         "findings": [],
         "firstSeen": {},
     }