STAC-25318 VEX containerd v2 false positives

[LouisLotter]

Summary

• add image-scoped OpenVEX not_affected statements for CVE-2026-50195, CVE-2026-53492, and CVE-2026-53489
• cover stackstate-k8s-agent and stackstate-k8s-process-agent across the Quay, Rancher, and SUSE distribution registries
• include bare OCI products for Grype matching and regenerate the Trivy VEX repository index
• document the bare-product requirement in the contributor guide

Analysis

All three upstream advisories affect the distinct github.com/containerd/containerd/v2 Go module in the 2.1, 2.2, and 2.3 release lines. The scanned binaries contain pkg:golang/github.com/containerd/[email protected]; they do not link the /v2 module. Grype 0.112.0 normalizes the module path and incorrectly applies the v2 advisories to the major-v1 module.

• GHSA-cvxm-645q-p574
• GHSA-33vj-92qq-66hc
• GHSA-rgh6-rfwx-v388

Validation

• python3 tools/build_index.py --check (60 packages, in sync)
• jq empty for both OpenVEX documents and index.json
• git diff --check
• Grype 0.112.0 against registry.rancher.com/suse-observability/stackstate-k8s-agent:3ce0270e: 0 remaining, 3 VEX-suppressed
• Grype 0.112.0 against registry.rancher.com/suse-observability/stackstate-k8s-process-agent:c570527c: 0 remaining, 3 VEX-suppressed

Jira: https://stackstate.atlassian.net/browse/STAC-25318