Correct vulnerability manifest references in workload summaries #5403

🤖 Generated by the Agentic Engineer

Description

Vulnerability summaries can point to manifests in the wrong namespace. Readers then receive a missing result even when the referenced scan exists, so complete paired coverage cannot be established.

Steps to Reproduce

1. Store vulnerability manifests in the scanner's configured namespace.
2. Store a summary for a workload in a different namespace.
3. Resolve the full-image and relevant-manifest references returned by that summary.

Expected Behavior

Both references identify the namespace in which their manifests were stored. The summary itself remains in the workload's namespace.

Actual Behavior

The manifest write uses the configured scanner namespace, but summary construction passes the workload namespace to the reference builder. The mismatch is visible in the pinned upstream source.

Acceptance Criteria

• Reproduce the mismatch with independently configured workload and manifest-storage namespaces, including relevant findings enabled and disabled.
• Preserve the summary's workload namespace while making every populated reference resolve in the actual manifest-storage namespace; retain names, counts and scan evidence.
• Deliver through a tested, signed immutable artifact and the protected deployment path without adding privileges or discarding stored findings.
• Observe fresh summaries whose references resolve by ordinary API reads and agree with their manifest counts. Preserve separate missing, stale and storage-coherence findings in the coverage check.

Part of #4263. The metadata-split repair in #5402 is a separate prerequisite for refreshing affected existing summaries; it does not correct reference construction.