docs: implementation plan for package inventory and CVE findings

17 tasks, TDD where the logic is pure. Corrects two spec claims:
the server reads features via License.HasFeature rather than admin's
entitlement directly, and shared/mail/render_test.go does not exist.

docs/superpowers/specs/2026-08-06-package-inventory-and-cve-findings-design.md

@@ -392,16 +392,26 @@ CVE; most fields would be disabled in the UI and the uptime graphs would be
 polluted with a signal that is not uptime.
 
 This adds one `notify` payload type and a `vuln_digest.html.tmpl` /
-`vuln_digest.txt.tmpl` pair in `shared/mail`, since `render_test.go` fails on
-any template no case covers.
+`vuln_digest.txt.tmpl` pair in `shared/mail`. Note that `shared/mail` templates
+are parsed in `init()`, so a mistyped field is a boot-time panic — CLAUDE.md
+describes a `render_test.go` guarding against exactly this, but **that file does
+not exist**; the repository has no Go tests at all today. The implementation
+plan adds it alongside this feature's own tests.
 
 ---
 
 ## Entitlement
 
-`entitlement.features.vuln_scanning`, a boolean alongside the existing
-per-instance feature toggles, so it can later be priced as a catalogue
-`feature` component without a second migration. Off on Free.
+The feature name is `vuln_scanning`, and it crosses the two services the way
+every other feature does:
+
+- **admin** carries it as a per-instance entitlement toggle, so it can later be
+  priced as a catalogue `feature` component without a second migration;
+- **the licence** snapshots it into `License.Features []string` at issue time;
+- **the server** asks `lic.HasFeature("vuln_scanning")` and never switches on
+  tier, so changing what a tier includes needs no server release.
+
+Off on Free.
 
 **The gate is checked at `ReportPackages`, not at display.** Gating only the UI
 would still pay every write cost, and storage is the expensive half.