sync: develop -> develop-v2 (util-linux acceptance, #1156)

[VijitSingh97]

Twin sync: develop → develop-v2, carrying #1157 (the util-linux acceptance for #1156).

Two commits, one file, one conflict — in .trivyignore, which both lanes edited today for different
reasons. That conflict is the whole content of this PR.

The conflict, and why neither side could win

• develop-v2 had fix(os): clear the appliance rootfs CVE gate at the source (#1153) #1154: the Go-binaries block rewritten, two mutes deleted (x/text and grpc,
  now fixed at the source by the GO_RAISES entries), and CVE-2026-34040 kept with new reasoning.
• develop had fix(ci): accept the three new util-linux advisories alongside 53615 (#1156) #1157: the util-linux entry rewritten to hold four advisories instead of one.

They overlap because they are adjacent blocks in the same file, so git presented one large hunk.
Taking --ours would have silently dropped the util-linux fix and left this lane's dashboard scan
red; taking --theirs would have dropped the entire #1154 rewrite and re-added two mutes for
findings that are now fixed at the source — the exact thing #1154 argues against, since a mute
over a fixed finding destroys the evidence the fix landed.

Resolved hunk-by-hunk, keeping this lane's Go-binaries block and the incoming util-linux entry, with
the resolution asserted rather than eyeballed:

assert 'COMPOSE_GO_RAISES' survives          # the #1154 rewrite
assert 'CVE-2026-34040' survives             # the docker/docker acceptance
assert 'NOTE ON GO STDLIB' survives          # the note that stops stdlib CVEs being re-accepted
assert the stale util-linux prose is gone    # superseded by the incoming one
assert the incoming block adds exactly 53612, 53613, 53614

Result — 8 accepted ids, and zero active entries for the two #1154 fixed at the source:

CVE-2026-45447  CVE-2026-23949  CVE-2026-24049  CVE-2026-34040
CVE-2026-53612  CVE-2026-53613  CVE-2026-53614  CVE-2026-53615

CVE-2026-56852 and GHSA-hrxh-6v49-42gf appear once each, in prose, in the sentence recording
that they were deleted and why.

Verified

bash tests/stack/run.sh → 2722 passed, 0 failed — the same count as develop-v2 before the
merge, which is what a docs-and-config-only sync should produce. Run because a twin sync is a
coverage event, not because this one changed code.

A standing difference this creates

develop still carries CVE-2026-56852 and GHSA-hrxh-6v49-42gf as active mutes; this lane no
longer does. That is correct — those findings live in the appliance rootfs binaries, which only
exist on develop-v2, so on develop they are entries for artefacts that lane does not build. But
it means .trivyignore now differs between the twins by two lines, and every future sync of this
file will conflict on the same region. Worth cleaning up on develop (they are dead there
regardless of this change); flagged rather than folded in, since it is a separate decision about a
lane this PR is not targeting.