feat(scanner-tuning): add suppression lifecycle model and drift evidence gates (#2724)

[zeroknowledge0x]

Closes #2724

Summary

Adds a Suppression Lifecycle Model and Drift Evidence Gates to the scanner-tuning skill, addressing two review gaps identified in #2724:

1. Indefinite suppressions becoming hidden true positives after drift — skill now requires expiry dates, named owners, and auto-re-open triggers on all suppressions
2. Compensating controls misclassified as false positives — FP Record and suppression dispositions now enforce the distinction between confirmed FP and compensated risk

Changes

Suppression Lifecycle Model (Step 2)

• Risk Tiers table: Safe / Moderate / Risky / Dangerous with scope, evidence, owner, expiry, and re-open trigger requirements per tier
• Safe Suppression Requirements template: mandatory fields including scope, disposition (FP vs compensated risk), evidence (rescan ID, package manager status, vendor advisory, compensating control ID), owner, expiry (never null), and auto-re-open triggers
• Critical distinction note: confirmed FP ≠ compensated risk — enforced throughout

Drift Evidence Gates (Step 2)

• Four drift gates: plugin update, asset exposure change, package change, compensating control removal
• Drift Gate Check template with suppression age, expiry status, and per-gate verdicts (Keep / Re-evaluate / Reopen)

Output Format Updates

• Suppression Inventory table: plugin/CVE, scope, disposition, owner, created, expires, age, re-open triggers, tier
• Drift Gate Audit table: per-suppression drift check results
• Metrics: orphaned count, expired count, indefinite count, compensated-risk-as-FP misclassification count

Disposition Enforcement

• Updated FP Record disposition options: confirmed FP (lifecycle model applies) | compensated risk (document separately, NOT a false positive)
• Added lifecycle note after Step 1 template
• Added suppression lifecycle rules to Prompt Injection Safety section

Common Pitfalls

• intel: devsecops/compliance social updates 2026-03-25 #6: Allowing indefinite suppressions without drift gates
• intel: appsec community updates 2026-03-29 #7: Recording compensated risk as false positive

[github-actions]

Thanks for the submission! 🙏 SecuritySkills is now issue-first: contributions need a linked issue that a maintainer has marked approved before a PR is opened.

Please open an issue describing the skill, wait for the approved label, then reopen this PR with Closes #<issue> in the description. The PR template lists everything we'll look for (including an independently runnable reproduction).