fix(zap): provide a deterministic informational scan fixture

Plan

1. Serve a controlled loopback HTML fixture in the scanner container and require a real ZAP rule 10027 informational alert.
2. Preserve the independent external crawl/active scan, raw artifact checks, report privacy and unchanged high-risk JUnit threshold.
3. Run complete exact-source CI and inspect actual scanner artifacts and cleanup before review.

Acceptance criteria

• Informational coverage no longer depends on changing external target content.
• The raw report must contain rule 10027 at the exact controlled fixture URL, and must retain the external scan site.
• Informational findings remain in raw artifacts but cannot leak into JUnit; high-risk findings still fail at the existing threshold.
• Five local behavioral regressions pass, including the missing/wrong fixture, wrong risk/plugin, independent external coverage, real HTTP readiness and cleanup on scanner failure.
• Shell syntax, YAML parsing, current-main rebase, final diff/whitespace checks and exact-branch GitLab CI compilation pass.
• Complete required exact-source CI, actual scanner evidence and final DoD pass.

Evidence and delivery boundary

The prior successful external crawl produced six findings and zero informational findings, so the report assertion could not pass reliably. The separate latest default-branch failure is a network timeout; this change does not suppress or retry away external availability failures. A real passive scan against a controlled TODO comment must provide the informational fixture. No report is injected or patched and no risk threshold, ordinary check or external scan is disabled.

uv run --with pyyaml python -c 'import subprocess; subprocess.run(["bash", "scripts/tests/zap-informational-fixture.ci-test.sh"], check=True)' passes all five tests. The real fixture HTTP server is exercised locally; mocked report tests are not claimed as live ZAP acceptance. Full pipeline and raw scanner evidence remain required.

Related to #452 (closed) and !616 (merged).

Closes #455 (closed)

Complete exact-source verification

Pipeline 3012198997 passes at unchanged source eb41c0ce. All 40 parent jobs and all 61 child pipelines are successful. Fully paginated child inspection covers 183 jobs; the only three failed jobs are pre-existing deliberate negative fixtures for Bash-unit-test failure reporting, deprecation and SonarQube findings. Their required report assertions pass; no allow-failure policy was added or changed. Both connected workflow trigger jobs confirm successful downstream completion.

Downloaded actual ZAP artifacts retain rule 10027 at the exact controlled URL, both external sites, and 17 JUnit cases with zero failures/errors and no informational case. All six stop/cleanup jobs pass; traces confirm deletion/destruction of owned Helm namespaces, Argo CD resources and Molecule platforms. The exact-source int environment is stopped; the Gruyere instance is explicitly ephemeral. Five local behavioral regressions pass again, including HTTP-server teardown.

Current-main rebase is a no-op. The clean five-file diff is reviewed, whitespace checks pass, no user-facing documentation change is needed, and the full paginated top-level/discussion audit has no unresolved feedback. Ready for guarded reviewer selection. This repairs fixture determinism only; external transport availability remains independently enforced. The repair must merge before dependent !616 (merged) resumes.