Handle shadowed gosu scan finding

docs/CI_SUPPLY_CHAIN.md

@@ -81,7 +81,13 @@ controls. The exception file has a mandatory review date; readiness and CI
 fail automatically after it expires. New advisories are never auto-ignored.
 The all-in-one image replaces the Go-based base-image `gosu` helper with a
 small `setpriv` exec wrapper and upgrades packaged setuptools/wheel metadata;
-these scanner findings are fixed rather than excepted.
+the final runtime filesystem no longer exposes the vulnerable Go executable.
+Because OCI layers are immutable, Trivy still records the shadowed Go binary
+from the official Postgres base layer in the complete JSON report. The
+release-policy pass skips only `/usr/local/bin/gosu` after the final image is
+verified to contain the audited shell wrapper. This is not a vulnerability
+exception: the raw evidence remains published and the runtime wrapper is
+exercised during live release validation.
 
 The container job builds a non-AI all-in-one image and uses digest-pinned
 scanner images: