refactor: drop the advisory policy-packs section and the findings cursor tooltip (#1369)

* refactor: drop the advisory policy-packs section and the findings cursor tooltip

Two Security-page cleanups from review.

- Remove the advisory policy-packs catalog from the Policies tab. It was
  information-only and disconnected from the scan_policies enforcement engine, so
  it read as duplicated. The tab now hosts only the enforcement manager, which is
  paid, so the Policies tab is hidden for Community (with a deep-link guard) and
  the Overview's enforcement hint is gated to match. The backend policy-packs
  catalog and route are kept as a dormant foundation. Delete the orphaned
  PolicyPacksTab component, its test, and the unused frontend pack types.
- Drop the cursor-follow tooltip from the findings severity badge (Secrets and
  Compose risks), matching the Images table.
- Clarify that Compose risks is a Trivy security-misconfig audit, distinct from
  Compose Doctor's deploy-readiness preflight, in the tab copy and the docs.

* chore: re-run CI

docs/features/security.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Security"
-description: "The command center for your fleet's security posture: an overview dashboard, image and Compose findings, secrets, scan history, suppressions, policy packs, and scanner setup, all in one place."
+description: "The command center for your fleet's security posture: an overview dashboard, image and Compose findings, secrets, scan history, suppressions, and scanner setup, all in one place."
 ---
 
 Security is a primary surface in Sencho. The **Security** page in the top navigation brings the
@@ -30,32 +30,23 @@ SBOM.
 
 ## Compose risks
 
-Compose risks surface misconfigurations in your stack definitions rather than image CVEs: privileged
-containers, Docker socket mounts, host networking, broad host bind mounts, missing healthchecks, public
-database ports, containers running as root, unpinned image tags, and missing restart policies. Each
-entry opens its scan report with the specific findings and how to fix them. The [Policy packs](#policy-packs)
-tab explains each category in depth.
+Compose risks surface the security misconfigurations Trivy finds in your stack definitions rather than
+image CVEs: privileged containers, Docker socket mounts, host networking, broad host bind mounts, public
+database ports, and containers running as root. Each entry opens its scan report with the specific
+findings and how to fix them. This is a security audit of the Compose file; for deploy-readiness checks
+(port conflicts, missing bind paths, unset variables, no healthcheck), use
+[Compose Doctor](/features/compose-doctor) from the stack page instead.
 
 ## Secrets
 
 The secrets tab lists images where Trivy detected exposed credentials or keys, and opens straight to
 the secret findings for a scan.
 
-## Policy packs
+## Policies
 
-Policy packs are curated bundles of security expectations for a deployment posture. Sencho ships five
-defaults:
-
-- **Homelab baseline**: gentle defaults for a single-operator homelab.
-- **Production hardening**: sensible hardening for services that face real traffic.
-- **Strict production**: a zero-tolerance posture for critical workloads.
-- **Public edge service**: focused on services exposed to the public internet.
-- **Internal service**: least-privilege defaults for east-west internal services.
-
-Each pack lists its rules with the severity, what the rule checks, why it matters, and how to fix it.
-Every rule is marked **warning** or **enforceable**. In Community, packs are advisory: they explain
-what good looks like. Block-on-deploy enforcement is an Admiral capability, configured under
-[scan policies](/features/vulnerability-scanning#scan-policies).
+The Policies tab manages deploy-enforcement scan policies: severity thresholds that block or warn on a
+deploy, scoped by stack pattern. Enforcement is an Admiral capability; see
+[scan policies](/features/vulnerability-scanning#scan-policies) for the full configuration.
 
 ## Suppressions
 

docs/features/vulnerability-scanning.mdx

@@ -3,7 +3,7 @@ title: "Vulnerability Scanning"
 description: "Scan container images and stack compose files for CVEs, secrets, and misconfigurations. Surface severity badges in the Resources Hub, compare scans over time, and gate deploys on policy violations."
 ---
 
-Sencho integrates with [Trivy](https://trivy.dev) to scan container images and Compose files for vulnerabilities (CVEs), hardcoded secrets, and misconfigurations. Findings surface as severity badges in the Resources Hub and as drillable reports in the scan drawer. The dedicated [Security page](/features/security) is the command center for risk review: overview, image findings, Compose risks, secrets, scan history, suppressions, policy packs, and scanner setup all live there. Manual scanning, secret and misconfig detection, scan history, comparison, scheduled fleet scans, CVE suppressions, single-scan SBOM export, and managed Trivy auto-update are available on every tier. Admiral adds policy enforcement and SARIF export.
+Sencho integrates with [Trivy](https://trivy.dev) to scan container images and Compose files for vulnerabilities (CVEs), hardcoded secrets, and misconfigurations. Findings surface as severity badges in the Resources Hub and as drillable reports in the scan drawer. The dedicated [Security page](/features/security) is the command center for risk review: overview, image findings, Compose risks, secrets, scan history, suppressions, and scanner setup all live there. Manual scanning, secret and misconfig detection, scan history, comparison, scheduled fleet scans, CVE suppressions, single-scan SBOM export, and managed Trivy auto-update are available on every tier. Admiral adds policy enforcement and SARIF export.
 
 <Frame>
   <img src="/images/vulnerability-scanning/resources-badges.png" alt="Resources Hub Images table with severity badges (CRITICAL, HIGH, MEDIUM) on managed image rows alongside the Scan history button" />
@@ -153,7 +153,7 @@ Policies define severity thresholds that govern whether a stack can deploy. A po
 See [Deploy Enforcement](/features/deploy-enforcement) for the full pre-flight flow, admin bypass path, and audit-log behavior.
 
 <Frame>
-  <img src="/images/vulnerability-scanning/security-settings.png" alt="The Security page Policies tab showing the policy-pack catalog, the Deploy enforcement policies section with an Add policy button, and the No scan policies configured empty state" />
+  <img src="/images/vulnerability-scanning/security-settings.png" alt="The Security page Policies tab showing the Deploy enforcement policies section with an Add policy button and the No scan policies configured empty state" />
 </Frame>
 
 ### Creating a policy
@@ -246,6 +246,10 @@ Full scans take longer than vulnerability-only scans because Trivy reads every f
 
 Beyond package CVEs, Sencho can run `trivy config` against a stack's Compose file to flag insecure defaults before you deploy. Typical checks cover privileged containers, missing resource limits, host networking, mounted Docker sockets, and overly broad capabilities.
 
+<Note>
+  This is a **security** audit of the Compose file, using Trivy's hardening rules. It is distinct from [Compose Doctor](/features/compose-doctor), which runs **deploy-readiness** checks (port conflicts, missing bind paths, unset variables, no healthcheck) before a deploy. Use Compose Doctor to confirm a stack will deploy cleanly; use Compose risk scanning to audit its security posture.
+</Note>
+
 From any stack page, open the **More actions** overflow menu next to the Update button and select **Scan config**. Sencho runs the scanner against the stack's working directory and opens the scan drawer on the **Misconfigs** tab.
 
 <Frame>