fix(security): tie fixable CVE posture to image-update evidence (#1815)

* fix(security): tie fixable CVE posture to image-update evidence

Stop treating Trivy fixed_version alone as an Update affected images CTA. Reuse persisted ImageUpdateService status so Security only offers Review update when an applicable image update is confirmed, and otherwise surfaces waiting or uncertain remediation with truthful affordances.

* fix(security): move image-update recheck helper out of OverviewTab

Satisfy react-refresh/only-export-components so Frontend lint passes.

* fix(security): preserve posture reason image targets in Images drill-down

Carry affected image refs on overview reasons so public exposure and related CTAs open a clearable targeted Images list instead of an unfiltered hunt.

* fix(security): attach Networking exposure intent to posture targets

Preserve stack/service context and intentional classification on network-exposed Security reasons without suppressing risk or claiming Internet reachability.

* fix(security): persist Images exposure intent and triage scope

Standing image summaries carry Networking intent context with cap-safe aggregates, Anatomy Networking links, and scan-sheet triage that defaults to the current image.

* fix(security): clear CI lint errors for exposure helpers

* fix(security): stop intentional exposure from forcing Action needed

Separate exposure fact, intent correctness, and vulnerability drivers so
package fixed_version cannot recreate a permanent public_exposure blocker.

* fix(security): define Monitoring residual-risk narrative

* fix(security): define Secure via residual Crit/High triage

Replace triage-blind raw Crit/High Secure gating with residual material
risk so accepted and ignored stay Monitoring, while not_affected, false
positive, and fixed can clear residual without claiming no detections.

* fix(security): exclude rollback-hold images from Security scans

Hold-only sencho-rb tags are recovery state; keep them out of Trivy node scans, Security inventory, and Overview posture while dual-tagged images remain under their registry tag.

* fix(security): keep authoritative no-update rows after preview

Opening a stack page must not delete ok+false stack_update_status evidence; Security treats a missing row as uncertain and would flip waiting-upstream to unknown.

backend/src/services/DockerController.ts

@@ -30,6 +30,7 @@ import { getErrorMessage } from '../utils/errors';
 import { sanitizeForLog } from '../utils/safeLog';
 import { describeSpawnError } from '../utils/spawnErrors';
 import { authoredComposeFileArgs, authoredComposeEnvFileArgs } from '../utils/authoredComposeArgs';
+import { isFullySyntheticHoldImage } from '../utils/senchoRollbackHold';
 import { isValidDockerNetworkName } from './network/dockerNetworkName';
 
 export type {
@@ -619,13 +620,9 @@ class DockerController {
       return undefined;
     };
 
-    // Only hide an image from the generic inventory when every visible tag is
-    // a synthetic sencho-rb hold tag; an image that also carries a normal
-    // registry tag stays visible here (with the badge below) so the generic
-    // inventory stays complete. Its generation still surfaces in the Rollback tab.
-    const isFullySyntheticHoldImage = (repoTags: string[]): boolean =>
-      repoTags.length > 0 && repoTags.every((tag) => tag.startsWith('sencho-rb/'));
-
+    // Hide hold-only images from generic inventory. Dual-tagged images (registry
+    // tag + hold) stay visible here with the badge below; generations still
+    // surface in the Rollback tab.
     const images: ClassifiedImage[] = this.validateApiData<any[]>(rawImages)
       .map((img: any) => {
         const usedByStacks = [...(imageToStacks.get(img.Id) ?? [])].sort((a, b) => a.localeCompare(b));