docs(17): resolve two implementation escalations on registry state and SSO egress

credential-required now comes from a declared registry list, because LAN egress
is excluded and the scanner could never receive a refusal from the private
registry. The egress list now names the Gateway and identity provider, which
the SSO sidecar needs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/17-vulnerability-visibility.md

@@ -91,7 +91,7 @@ Every inventoried target has exactly one state:
 | `pending` | Discovered and not yet scanned, within the 2-hour window. |
 | `stale` | Last successful scan is older than the 24-hour window. Prior findings are retained and labelled stale. |
 | `failed` | The most recent attempt failed. The reason is shown. Prior findings are retained. |
-| `credential-required` | The registry refused anonymous access. Shown with the registry. |
+| `credential-required` | The image is on a registry declared as needing a credential the scanner does not hold. Shown with the registry. A declared list is used because the private registry sits on the LAN, which the scanner's egress excludes, so it would otherwise surface as a network failure. |
 | `by-tag` | Scanned by mutable reference, because no running digest exists. |
 | `not-covered` | A target class this scanner cannot examine: VMs and nodes. |
 
@@ -244,8 +244,9 @@ compromised in March 2026 ([CVE-2026-33634](https://nvd.nist.gov/vuln/detail/CVE
   **nothing else**. It MUST NOT read Secrets or hold any write verb on the Kubernetes API.
 - It holds no git credential and no registry credential.
 - Network: ingress only from the Gateway for the page, from CI for the internal API and from
-  Prometheus for metrics. Egress only to the Kubernetes API, DNS, and TCP/443 on the public internet,
-  with cluster and LAN ranges excluded, through the direct path.
+  Prometheus for metrics. Egress only to the Kubernetes API, DNS, the platform Gateway and identity provider (required by the
+  SSO sidecar), and TCP/443 on the public internet, with cluster and LAN ranges otherwise excluded,
+  through the direct path.
 - It runs unprivileged, with a read-only root filesystem and no host namespaces or mounts.
 - The scanner's own images appear in the report like any other.