credential-required now comes from a declared registry list, because LAN egress
is excluded and the scanner could never receive a refusal from the private
registry. The egress list now names the Gateway and identity provider, which
the SSO sidecar needs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
jakman85andClaude Opus 5.5