[#452] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

PRIVATE repo: vulnerability + posture data. scap/openvas/cmmc/bor/pentest
structure mapped to existing ticket set.
https://projects.knownelement.com/issues/452#note-4538

.env.example

@@ -0,0 +1,8 @@
+# compliance repo consumes no secrets from env files by design: node access is
+# root-SSH over Tailscale (keys via ssh-agent), and env.sh (sourced) holds
+# node rosters + wire-plan constants. Copy env.sh values from the cluster
+# runbook; never commit real kubeconfigs or tokens.
+#
+# Optional overrides when driving scripts by hand:
+#SSH_USER=reachableceo
+#SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)