docs(cloud-security): Code Scanning

[maximelb]

Documents the AppSec code lane for Cloud Security.

New page cloud-security/code-scanning.md:

• what each engine scans and which finding class it produces
• the sandbox model, stated as an invariant rather than a reassurance: the code has to be read to be scanned, so the guarantee is that it is never kept — ephemeral container in-region, no cloud identity, repo-scoped 1h token, only the normalized report leaves, secrets stored as a salted hash
• enabling it: the Contents: Read-only permission (and why GitHub needs an owner to approve a permission increase on an existing installation), then the opt-in code_scanning policy field by field, including the two footguns — an empty include means every repository, and a ! in exclude cancels the include list
• the CLI (limacharlie cloudsec code repos|status|sbom), the --repo findings filter, and the SBOM's "downloadable artifact, not inventory rows" contract
• the graph joins (built-from / runs-image) and the four pack queries built on them
• the two compliance frameworks, with the coverage qualifier explained
• limits, and a Not yet available section listing by name the capabilities that do not ship — an absent detector otherwise reads as a clean result

Cross-links: providers.md (GitHub section), findings.md (the three new finding classes and where they come from), compliance.md (thirteen frameworks), provider-setup/github.md (the Contents permission row + a section on it), and the nav.

Deliberately not documented as available: static analysis, push-triggered rescans, PR checks/gating, auto-fix PRs, BYO SARIF/CycloneDX ingest, and non-GitHub source control. Each is named in "Not yet available" instead.

🤖 Generated with Claude Code

[maximelb]

HELD OPEN for the final docs round — not to be merged with the code PRs (per the repo's own convention).

State: all 7 checks green (mkdocs build --strict, link check, markdown lint, snippet compiles, unit tests). Content matches what shipped in go-cloudsec v1.35.0 and legion_graph v1.33.0, both live on exp.

Two things a reviewer of the docs round should re-check against the code at that time, because both were moving while this was written:

1. "Not yet available → Static analysis (SAST)" — accurate for the shipped default (the sast switch is policy-default-off), but the engine is running on the exp estate. If SAST has gone GA by the docs round, this section and the Compliance section both need a pass.
2. The compliance paragraph says the outcome-graded controls wait for a completed scan pass. That is live and verified. The five OWASP categories that are ungraded are ungraded for want of a sast_scanned signal, not a missing engine — if that signal lands, the "5 of 10" phrasing changes.

Everything else is measured against the live exp run rather than the design docs.

[maximelb]

Superseded by #362, which consolidates this branch with the other code-lane docs branches into one page set off master and reconciles every claim against the shipped code (nine differences are listed in that PR's body). Leaving this open rather than closing it — Maxime closes.