docs(cloud-security): Code Scanning

[maximelb]

Documents the AppSec code lane for Cloud Security.

New page cloud-security/code-scanning.md:

• what each engine scans and which finding class it produces
• the sandbox model, stated as an invariant rather than a reassurance: the code has to be read to be scanned, so the guarantee is that it is never kept — ephemeral container in-region, no cloud identity, repo-scoped 1h token, only the normalized report leaves, secrets stored as a salted hash
• enabling it: the Contents: Read-only permission (and why GitHub needs an owner to approve a permission increase on an existing installation), then the opt-in code_scanning policy field by field, including the two footguns — an empty include means every repository, and a ! in exclude cancels the include list
• the CLI (limacharlie cloudsec code repos|status|sbom), the --repo findings filter, and the SBOM's "downloadable artifact, not inventory rows" contract
• the graph joins (built-from / runs-image) and the four pack queries built on them
• the two compliance frameworks, with the coverage qualifier explained
• limits, and a Not yet available section listing by name the capabilities that do not ship — an absent detector otherwise reads as a clean result

Cross-links: providers.md (GitHub section), findings.md (the three new finding classes and where they come from), compliance.md (thirteen frameworks), provider-setup/github.md (the Contents permission row + a section on it), and the nav.

Deliberately not documented as available: static analysis, push-triggered rescans, PR checks/gating, auto-fix PRs, BYO SARIF/CycloneDX ingest, and non-GitHub source control. Each is named in "Not yet available" instead.

🤖 Generated with Claude Code

[maximelb]

HELD OPEN for the final docs round — not to be merged with the code PRs (per the repo's own convention).

State: all 7 checks green (mkdocs build --strict, link check, markdown lint, snippet compiles, unit tests). Content matches what shipped in go-cloudsec v1.35.0 and legion_graph v1.33.0, both live on exp.

Two things a reviewer of the docs round should re-check against the code at that time, because both were moving while this was written:

1. "Not yet available → Static analysis (SAST)" — accurate for the shipped default (the sast switch is policy-default-off), but the engine is running on the exp estate. If SAST has gone GA by the docs round, this section and the Compliance section both need a pass.
2. The compliance paragraph says the outcome-graded controls wait for a completed scan pass. That is live and verified. The five OWASP categories that are ungraded are ungraded for want of a sast_scanned signal, not a missing engine — if that signal lands, the "5 of 10" phrasing changes.

Everything else is measured against the live exp run rather than the design docs.