v0.28.1 — ingest leniency, Trivy 0.73.0, agent DB-metadata fix

Patch release: ingest robustness, recommended Trivy 0.73.0, and an agent-side Trivy DB metadata fix. No schema change, no migration — upgrade in place.

TICKET-023: Trivy DB metadata read after the scan, not before

Fixed

• The agent now reads trivy version --format json after the rootfs
  scan instead of before it, so the reported DB version/timestamps reflect
  the DB the scan actually used. Previously a host whose DB refreshed
  during the scan submitted fresh findings but reported the pre-scan DB
  state, showing a trivy-db stale pill that was already wrong. Agent-side
  only — server, schema and UI are unchanged.

Changed

• AGENT_VERSION / CURRENT_AGENT_VERSION bumped 0.10.0 → 0.11.0 so
  the fix reaches hosts via auto_update_self. Hosts pick it up on their
  next run; no backfill of existing servers.trivy_db_* rows.

TICKET-022: bump recommended Trivy to 0.73.0

Changed

• RECOMMENDED_TRIVY_VERSION raised from 0.71.0 to 0.73.0. Every host
  with a fathometer-managed Trivy binary picks up the new version on its
  next scheduled run via the existing auto_update_trivy mechanism —
  server-side only, no agent update needed. MIN_TRIVY_VERSION stays
  0.70.0; hosts on a system-package Trivy are unaffected.

TICKET-021 (ADR-0072): per-vulnerability ingest leniency

Fixed

• A single non-conforming vulnerability entry no longer discards the whole
  scan (#22,
  #23):
  Vulnerabilities is validated per entry, so a bad entry drops itself while
  the remaining findings ingest. Accepted identifiers now cover TEMP-*
  (Debian Security Tracker), DSA, DLA, RUSTSEC, GO and PYSEC next to
  CVE and GHSA; over-long Title/Description are trimmed instead of
  rejected. Server-side only — no agent update needed, previously failed scans
  are not backfilled.
• Bulk-acknowledge by identifier accepts the same identifier set, so non-CVE
  findings can be acknowledged in bulk.

Added

• Dropped entries are counted per scan and reported as vulns_dropped in the
  scan.ingested audit metadata, the scan-ingest job result and the log.

Full changelog: v0.28.0...v0.28.1