Improve scanner-tuning asset identity evidence

[tiandashu]

Closes #2007

Summary

• Adds an asset identity freshness gate to the scanner-tuning skill so suppressions must prove that scanner findings still map to the current canonical asset.
• Requires scanner asset IDs, stable CMDB/cloud/container identifiers, last-seen timestamps, and explicit stale/replaced asset handling before accepting tuning exceptions.
• Adds an output table and pitfall guidance for ephemeral hosts, mutable image tags, and digest-scoped container suppressions.

Fixtures

• skills/vuln-management/scanner-tuning/tests/vulnerable/stale-ephemeral-asset.yaml
• skills/vuln-management/scanner-tuning/tests/vulnerable/mutable-image-tag-drift.yaml
• skills/vuln-management/scanner-tuning/tests/benign/current-cloud-asset-match.yaml
• skills/vuln-management/scanner-tuning/tests/benign/digest-scoped-container-suppression.yaml

Validation

• git diff --check
• Parsed all four YAML fixtures with PyYAML
• Verified the new Asset Identity Freshness Gate and required evidence markers are present
• Verified fixture count: 2 vulnerable and 2 benign

Bounty

Requesting Improver Moderate ($100) if accepted. Payment details can be shared privately after acceptance.