docs: implementation plan for package inventory and CVE findings
17 tasks, TDD where the logic is pure. Corrects two spec claims: the server reads features via License.HasFeature rather than admin's entitlement directly, and shared/mail/render_test.go does not exist.
This commit is contained in: