[#389] official Greenbone compose, loopback; gvm-config+nginx digest-pinned

Docker Hub greenbone/* discontinued — official stack from
registry.community.greenbone.net via the maintained compose.yaml (already
loopback-bound). :latest tags digest-pinned per house rule.
https://projects.knownelement.com/issues/389

openvas/README.md

@@ -38,3 +38,23 @@ GLPI CMDB (computers, read-only via mglpi identity)
 - [ ] GVM bring-up + first feed import (next run: feeds download several GB)
 - [ ] First sectestbed scan + findings triage into Redmine
 - [ ] kali-tsys production engine under CR (#389)
+
+## GVM stack (app-test lane) — official Greenbone Community Edition
+
+`docker/gvm-test/compose.yaml` = the OFFICIAL Greenbone compose (fetched
+2026-09-05 from https://greenbone.github.io/docs/latest/_static/compose.yaml,
+already loopback-bound: 127.0.0.1:443 + 127.0.0.1:9392). Registry:
+registry.community.greenbone.net (Docker Hub greenbone/* is discontinued;
+ghcr.io/greenbone/gvmd exists but the official stack uses the community
+registry — use the official file as-is).
+
+Bring-up:
+    cd docker/gvm-test && docker compose -f compose.yaml pull && docker compose -f compose.yaml up -d
+    # admin password reset:
+    docker compose -f compose.yaml exec -u gvmd gvmd gvmd --user=admin --new-password='<pw>'
+Feed sync runs on first start (multi-GB, takes hours — check
+`docker compose logs -f gvmd`).
+
+Import GLPI targets once feeds are loaded (gvm-tools service in the compose):
+    ../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp
+    docker compose -f compose.yaml run --rm gvm-tools ...   # see #389 note