Remove dead scope-none rules, fix stale CDS-SEC docs

[SemTiOne]

Pull Request

Summary

Delete unused CDS-SEC-050/051/052/053/054 from the bundled rule set (enforcement lives in cli/image_verification.py). Disable CDS-SEC-006/032 so no scope: ["none"] rule appears active. Add regression guards for #354, #355, #397. Fix stale docs.

Closes #354, Closes #355, and Closes #397

Type Of Change

• Bug fix
• Feature
• Refactor
• Docs
• Test only

User Impact

N/A

Validation

python -m unittest tests.test_security tests.test_preflight tests.test_image_verification  # 87 OK
python -m unittest discover -s tests -p "test_*.py"  # All OK
ruff check . # Clean
npx --yes markdownlint-cli@0.49.0 CHANGELOG.md docs/*.md # Clean

Checklist

• Tests added or updated
• Docs updated (README or docs)
• No secrets committed
• Generated artifacts excluded from git

[RonaldHensbergen]

Reviewed the diff (CHANGELOG, cli/resources/rule-set.json, cli/image_verification.py, docs/image-signing.md, docs/threat-model.md, docs/vm-postgres-odbc-access.md, tests/test_image_verification.py, tests/test_preflight.py, tests/test_security.py).

• Deletion of CDS-SEC-050/051/052/053/054 from rule-set.json is clean — no dangling commas/whitespace, JSON still valid, schema still validates.
• CDS-SEC-006/032 correctly flipped to enabled:false; new test_no_scope_none_rule_is_enabled regression guard in test_security.py enforces this going forward.
• Docs (image-signing.md, threat-model.md, vm-postgres-odbc-access.md) and the image_verification.py docstring are consistently updated to stop citing the deleted rule IDs while correctly noting image_verification.py still emits findings under CDS-SEC-050/051/052.
• New regression tests (#354, #355, #397) pass; ran the full targeted suite (test_security, test_image_verification, test_preflight) against this exact branch — 87/87 pass.
• No stale references to the deleted rule IDs remain anywhere in the tree.

LGTM.