docs: P2 backlog — split VEX guide, relocate cosign how-to, release SBOM, onboarding polish

[haksungjang]

Summary

The seven P2 items from the 2026-07 documentation benchmark review. Contains two workflow changes (docs.yml, release.yml), so CI runs normally on this PR.

1. user-guide/vex.md — VEX sections split out of the vulnerabilities page

vulnerabilities.md mixed reference, how-to and explanation across 21 H2s (783 lines). The three VEX-document sections (export / import / UI, ~230 lines) now live in their own page; the vulnerabilities page keeps triage (state machine, EPSS/KEV, fixed version, upgrade views) plus a short pointer section. No inbound links targeted the moved anchors (verified); in-page cross-links and the FAQ answer were rewired; docs-uat ids moved with their content — extract is green with 32 enrolled docs / 201 steps, KO parity intact.

2. sbom-signature-verification relocated: reference → ci-integration

The page is a five-step how-to (install cosign → download artifacts → verify → key setup) that sat in the reference shelf. Moved via git mv (EN+KO), sidebar updated, all six inbound links and the page's own relative links fixed.

3. Every release now ships its own SBOM

release.yml's release job generates a CycloneDX SBOM of the release's checked-out source tree (anchore/sbom-action) and attaches it to the draft Release as trusca-X.Y.Z.cdx.json — idempotent on re-runs (--clobber, and the existing-release early-exit is unaffected). Documented in releasing.md. This is the Dependency-Track convention: an SCA product publishes its own SBOM.

4. Quickstart: first-boot Trivy DB caution

Step 5 (first real scan) now warns that a fresh stack can finish a scan before the initial Trivy DB download lands — components visible, zero vulnerabilities — and that the automatic re-match fills findings in without a re-scan.

5. Accurate "last updated" stamps

editUrl / editLocalizedFiles / showLastUpdateTime were already configured; the actual gap was the deploy workflow's shallow checkout, which would stamp every page with the deploy date. docs.yml now checks out with fetch-depth: 0.

6. Roadmap hygiene (integrations, components-and-licenses)

Inline "X is on the roadmap" promises are rewritten as present-tense behaviour plus a (see Roadmap) pointer; each promise now lives exactly once in the page's Roadmap section. Two promises that had no Roadmap entry (scope picker UI; richer obligation taxonomy) were added there.

7. Trivy-DB-not-arrived troubleshooting — verified, no change

On inspection the three narrations had already converged (canonical: vulnerability-data.md#troubleshooting; scans.md and docker-compose.md are short pointers). Splitting a separate troubleshooting page was rejected — it would duplicate the oncall-runbook's role as the incident entry point.

Verification

• Docusaurus EN+KO build green — 0 broken links/anchors across the split and the move
• docs-uat extract green — 32 enrolled docs, 201 steps, EN/KO id parity
• ko-style lint S1/S2/S3 all 0 (66 files)
• Both workflow files parse (yaml.safe_load); release.yml change is tag-scoped and exercised on the next release