Add tailored SCAP container profile

[joey-huckabee]

Summary

• add a 36-rule image-owned XCCDF profile and complete selection/exclusion rationale
• correct immutable ClickHouse program ownership while preserving the non-root runtime contract
• bind CI evidence to the tailoring hash and independently verify the evaluated selector set
• begin a new report-only AMD64/ARM64 stabilization cycle

Local verification

• Python unit tests: 13 passed
• all 36 selectors exist in pinned ComplianceAsCode 0.1.82 content
• workflow YAML and XML parse; git diff --check passes
• native container/OpenSCAP and lint tool verification delegated to PR CI because this Windows host has no available Docker, Podman, or WSL runtime