Define configuration vulnerability annotation semantics

[March-77]

Summary

• independently define annotation semantics for configuration and non-taint vulnerabilities
• rebuild the four OpenClaw Dockerfile entries consistently under the existing schema
• use base-image user inheritance as the configuration entry, effective privileged instructions as sinks, and configuration lifecycle rather than taint as trace semantics
• represent missing USER directives without inventing nonexistent source lines
• identify NOPASSWD:ALL as the explicit dangerous configuration in the nominally non-root image
• include source-backed patch JSONL, field diff, reproducible builder, guidance, and tests

Annotation decisions

• entry-00241: inherited root reaches builds and CMD ["bash"]
• entry-00242: copied application/dependency installation runs as root
• entry-00243: install test entrypoint launches as root
• entry-00244: USER app is undermined by unrestricted passwordless sudo

The documentation proposes optional future annotation_kind and evidence_relation fields, but this PR introduces no schema changes.

Validation

• 4 patch rows and 12 field-level diff rows
• 19/19 replacement nodes exactly match the pinned OpenClaw source
• python -m unittest discover -s tests -p "test_config_vuln_annotations.py" -v (4 tests)
• python -m py_compile scripts/build_config_vuln_annotations.py
• git diff --check

Closes #8