feat: vuln_scanning entitlement and documentation

Adds license.FeatureVulnScanning as the one name for the feature and a
catalogue row per deployment/tier, following console and oidc: features
are opt-in per customer, so no plan bundles it.

Documents the subsystem in CLAUDE.md, including that ScopedCollections is
the canonical registry instance deletion derives from — there is no
separate deletion list, which the plan had wrong.

shared/license/license.go

@@ -31,6 +31,10 @@ const (
 
 	FeatureConsole = "console" // browser SSH/RDP/VNC
 	FeatureOIDC    = "oidc"    // per-instance single sign-on
+	// FeatureVulnScanning gates package inventory collection as well as the
+	// findings themselves. The gate is at collection, not display: an ungated
+	// instance stores no inventory, and storage is the expensive half.
+	FeatureVulnScanning = "vuln_scanning"
 )
 
 // Support levels. Carried for display and enforced by nothing — there is no code