docs(cloud security): the consolidated Code Scanning docs — supersedes #355, #360, #361

[maximelb]

Draft, and it stays a draft — this repo is public and the code lane is not
announced. It supersedes four in-flight branches; it is here so the docs round
is reviewable as one thing rather than as a stack.

What this replaces

PR	State	Folded in
#355 code lane	open draft	the page, the findings/compliance/providers/nav edits
#357 alert permissions	already merged	built on, not restated
#360 bring your own scanner	open draft, stacked on #355	the BYO section and the Actions recipe
#361 IDE & MCP	open draft	mcp.md, with the autofix tool corrected

All three open ones are left open with a comment pointing here; closing them is
yours.

Where the branches and the code disagreed

Every claim was checked against legion_cloudsec_host/docs/CODE-LANE.md,
go-cloudsec/docs/API-CONTRACT.md, the hive schema and the tracker rows. The
code won each time. Nine differences, worth reading before approving:

1. Static analysis ships. docs(code-scanning): bring your own scanner (P2.2) — HOLD OPEN #360's "Not yet available" listed SAST as
   unshipped. It landed with a curated CWE-mapped rule pack; it is off by
   default in the policy, which is a different statement, and the page makes it.
2. Push-triggered rescans ship. Also listed as unavailable. The webhook
   adapter, the shipped D&R recipe and the debounce are documented.
3. Pull-request checks and merge gating ship, via the separate opt-in write
   App. docs(code-scanning): bring your own scanner (P2.2) — HOLD OPEN #360 said they "need write access, which the read-only connector does
   not have and will not gain" — the second half is right and load-bearing, the
   conclusion was not.
4. Dependency AutoFix ships, with the npm / go lockfile limitation stated in
   the table rather than implied.
5. severity_floor does not filter. Both branches said it "drops code
   findings below this severity". It is validated, stored and composed; nothing
   applies it yet. Now carries an explicit note.
6. scan_status reads unknown for every repository today — the
   per-repository scan props live on the lane's own status document and are not
   merged onto the inventory row, so the field reports
   repo_scan_props_not_projected. Documented as a known state with the
   authoritative alternative (code status) named, rather than described as if
   it worked.
7. OWASP Top 10 is fully assessable now (ten of ten once static analysis has
   run over a repository), not five of ten.
8. image_sources: ["registries"] is accepted and not enumerated. Named in
   "Not yet available" instead of listed as a working option.
9. sast_ruleset: custom:<ref> is accepted by the policy validator and
   refused by the scanner — and because the scan then reports an error, that
   repository's unrelated findings stop being swept. Documented as a thing not
   to set, with the consequence.

What the review then caught

Every command on the page was run against the CLI's own source rather than read,
which found seven copy-paste failures — all fixed in the second commit:
--finding-class is --class; the Actions recipe invented limacharlie login
and --alias (the group is auth, and there is no alias option), so the
workflow died before it scanned; local secret scanning is refused, not "off
by default", which the MCP page in this same PR already said correctly; the
webhook heredoc used $OID and $INSTALLATION_KEY without defining them, in an
unquoted heredoc, so a reader wrote an empty identity; image_sources is a list
and appeared twice as a bare scalar.

Two things that gate merging, beyond the rollout

• mcp.md documents tools that do not exist yet. lc-mcp-server Enhance billing report with per-tenant SKU breakdown and auto-browser launch #58, Add untask action documentation to Reliable Tasking extension #59
  and Add Velociraptor DFIR functions to lc-essentials plugin #60 are open and unmerged — none of the four cloudsec_code_* tools is on
  that repo's master. Adding - IDE & MCP: cloud-security/mcp.md to mkdocs.yml
  is publication, so if this merges first, drop that nav line and the two
  links to the page.
• No published CLI release carries the cloudsec code group. It is newer
  than the newest tag, so every limacharlie cloudsec code … line here answers
  No such command to a reader who installs today. A python-limacharlie
  release is a prerequisite; the page says to upgrade, which is only true once
  one exists.

Both are tracked as go-cloudsec roadmap 15 §10 items 35b and 36 (PR
go-cloudsec#240).

Deliberately not here

• No competitor or vendor names. Scanner engines, rule-pack vendors and
  other source-control platforms are described by what they do. One consequence:
  the sast_ruleset alternative pack value is not documented — only the curated
  default and the fact that custom: does not work.
• The webhook adapter page is not edited. The code lane links to the existing
  tutorial and carries only the record shape it needs; none of the four branches
  touched that page either.
• No release-note entry. That is legion_deployments#5197, held for the
  production rollout.