DECISION: trivy limit-severities-for-sarif (CRITICAL/HIGH only)

[seonghobae]

keyverse trivy-fs still exits on LOW/MED opinionated K8s misconfigs (untrusted registry=official keycloak/postgres images, runAsUser, default namespace). Clean fix = set limit-severities-for-sarif:true in the central Security Scan workflow. Held pending your strict-security preference.

---

Roadmap item — CWL Project #1 (naruon Platform Roadmap). Phase Decision · Component dot-github. Spec: ContextualWisdomLab/naruon#974 (docs/planning/naruon-platform-plan.md).