Feature: Add remediation cases, SLAs, approvals, and metrics

[JustNZ]

Release

Release 2 — VEX and remediation operations

Goal

Turn findings and suppressions into an accountable remediation workflow.

Scope

• Add remediation states: open, investigating, planned, mitigated, resolved, accepted_risk, and false_positive.
• Track owner, priority factors, due date, affected products, evidence, approvals, external references, and activity history.
• Configure SLAs using explicit factors including KEV, severity, asset criticality, exposure, and fix availability.
• Migrate existing suppressions into equivalent decision records without losing history.
• Add aging, overdue, mean-time-to-triage, mean-time-to-remediate, recurring-component, and exception-review dashboards.

Acceptance criteria

• Accepted-risk and false-positive decisions require scope, justification, expiry, and approver.
• Expired decisions reopen or return to review according to organization policy.
• SLA calculation is deterministic and audit-visible.
• Metrics exclude operational scan failures from policy passes.
• Migration preserves existing suppression ownership and timestamps.