Finalize UI truthfulness and bootstrap hardening

docs/qa/feature-checks/runs/web/image-security-release-backed-ui/run-001/evidence/playwright-ui-evidence.txt

@@ -0,0 +1,17 @@
+Tier2 strict UI evidence for image-security-release-backed-ui
+CapturedAtUtc: 2026-04-15T17:03:18Z
+Playwright command: PLAYWRIGHT_BASE_URL=https://stella-ops.local npx playwright test --config playwright.config.ts tests/e2e/ui-truthful-state-cutover.recheck.spec.ts --workers=1 --reporter=list
+Playwright test mapping: rechecks mounted truthful-state routes after the mock-data cutover
+Route: /security/images
+Assertions:
+- heading "Image Security" is visible
+- "No image security scope selected" empty state is visible before selecting a release
+- selecting a live release renders "Release images"
+- VEX tab shows "The current findings contract exposes VEX status only."
+- Evidence tab shows "The mounted image-security route has access to release-level evidence posture only."
+Command output snippet:
+- Running 2 tests using 1 worker
+- ✓ rechecks mounted truthful-state routes after the mock-data cutover (22.4s)
+- ✓ rechecks policy governance conflicts without fabricated preview content (11.2s)
+- 2 passed (34.9s)
+Result: pass

docs/qa/feature-checks/runs/web/image-security-release-backed-ui/run-001/tier2-ui-check.json

@@ -0,0 +1,48 @@
+{
+  "type": "ui",
+  "module": "web",
+  "feature": "image-security-release-backed-ui",
+  "runId": "run-001",
+  "baseUrl": "https://stella-ops.local",
+  "capturedAtUtc": "2026-04-15T17:03:18Z",
+  "playwrightSpec": "src/Web/StellaOps.Web/tests/e2e/ui-truthful-state-cutover.recheck.spec.ts",
+  "playwrightTests": [
+    "rechecks mounted truthful-state routes after the mock-data cutover"
+  ],
+  "steps": [
+    {
+      "description": "Open the mounted image security route.",
+      "action": "navigate",
+      "target": "/security/images",
+      "expected": "The route renders Image Security with release and environment selectors plus a truthful empty state.",
+      "result": "pass",
+      "stepCapturedAtUtc": "2026-04-15T17:03:18Z"
+    },
+    {
+      "description": "Select a live release from the scope bar.",
+      "action": "select",
+      "target": "Release selector",
+      "expected": "The summary tab renders Release images from live release-backed data.",
+      "result": "pass",
+      "stepCapturedAtUtc": "2026-04-15T17:03:18Z"
+    },
+    {
+      "description": "Open the VEX tab and verify truthful contract messaging.",
+      "action": "click+assert",
+      "target": "VEX tab",
+      "expected": "The mounted route reports that the current findings contract exposes VEX status only.",
+      "result": "pass",
+      "stepCapturedAtUtc": "2026-04-15T17:03:18Z"
+    },
+    {
+      "description": "Open the Evidence tab and verify release-level limitation copy.",
+      "action": "click+assert",
+      "target": "Evidence tab",
+      "expected": "The mounted route reports release-level evidence posture only instead of fake image-level evidence rows.",
+      "result": "pass",
+      "stepCapturedAtUtc": "2026-04-15T17:03:18Z"
+    }
+  ],
+  "evidence": "docs/qa/feature-checks/runs/web/image-security-release-backed-ui/run-001/evidence/playwright-ui-evidence.txt",
+  "verdict": "pass"
+}