feat(vex): assess the five advisories Grype reports beyond Trivy

The OpenVEX set that shipped covered what Trivy 0.74.0 reports. Grype 0.118.0 reports seven findings on the same published image: two are alias spellings the existing statements already match, and five are distinct advisories nothing covered. This assesses those five, so one document answers both scanners.

CVE-2026-34040 in github.com/docker/docker is not_affected with vulnerable_code_not_present. The vulnerable code is the daemon's authorization plugin middleware, both binaries carry zero symbols under pkg/authorization and api/server, and the advisory states that anyone not using AuthZ plugins is not affected. That absence is what separates it from the four other docker/docker findings, which stay affected because both binaries link pkg/archive, where their archive and mount flaws sit. The three containerd advisories, CVE-2026-53492, CVE-2026-50195 and CVE-2026-53489 against v1.7.33, are not_affected on the same justification: their upstream advisory covers containerd/containerd/v2 only, fixed at 2.1.9, 2.2.5 and 2.3.2, and this binary carries that module at v2.2.5, while the path a scanner matches is the retired major, present for one package, platforms. GO-2026-6225 in github.com/chrismellard/docker-credential-acr-env is affected because its pkg/credhelper is linked and both symbols the advisory names are present.

Three classes carry them: cri-packages-not-linked, authz-packages-not-linked and upstream-module-abandoned.

One correction to record. The published binaries are stripped, so go tool nm reports no symbol section, and every count here comes from strings -a on the extracted binary, the method the shipped GO-2026-5932 entry used. As a control it reproduces that entry exactly: 0 symbols under golang.org/x/crypto/openpgp and 607 under the ProtonMail fork. Counts were taken on /kaniko/executor and repeated on /kaniko/warmer.

None of the five is an override candidate: containerd's fix sits at a module path this binary already carries at the fixed version, docker/docker ends at v28.5.2+incompatible, and docker-credential-acr-env has no tagged release at all.

Measured on the published standard digest, Trivy reports 6 findings without the document and 5 with it, unchanged, because it reports none of the five. Grype reports 7 without and 3 with. Lint renders 11 statements for each of the six variants, 6 affected and 5 not_affected.