fix: assess util-linux mount advisory

[cristibleotiu]

Problem

The scheduled security scan failed on CVE-2026-53613 in util-linux for the immutable v1.0.0 image. The advisory affects setuid mount target-path handling for restricted user mounts.

Assessment

The scratch runtime retains only non-setuid setsid from util-linux. It contains no mount, umount, libmount, or /etc/fstab, so the vulnerable code path is not present. The exact published digest was inspected and rescanned with the reviewed VEX decision.

Changes

• add an exact, fail-closed OpenVEX not_affected decision for CVE-2026-53613
• enforce the minimal-runtime evidence in the VEX verifier and release-contract tests
• bump the release identity to v1.0.1 because periodic scans consume release-bound VEX
• update release documentation and regenerate source/manifest.sha256

Verification

• python3 -m unittest tests.test_release_contract tests.test_sbom_contract (60 tests)
• python3 scripts/verify-security-vex.py
• static provenance, license, fixture, source-boundary, and source-manifest checks
• Trivy 0.73.0 replay against ghcr.io/ratio1/r1-meshdb@sha256:3be00a63467628d0f5c3382be8ae7a885c5b658762dfd095fba0cb0b5549fab4 with the updated VEX (zero unsuppressed HIGH/CRITICAL findings)

Release impact

Merging the VERSION change starts the gated v1.0.1 release workflow. This draft does not merge or publish the release.