[stackstate-agent] Make CVE exception expiry dates fail closed

[ai-collaboration-app]

The exceptions/ tree carries expires dates that nothing enforces, so a lapsed
CVE deferral in this repo goes unnoticed.

The evaluator behind the scan does fail closed on expiry — a missing, unparseable
or past expires turns the exception back into a live finding — but
ExitCode returns 0 unconditionally in inform mode, and this repo's only
consumer of the tree is the report-only scan in build-deb.yml
(mode: inform, since #487). The gating chart scan in StackVista/cve-reporter
does not read the tree at all. Net effect: the dates are advisory.

All four current exception files expire 2026-09-04, and two of them
(CVE-2025-15367, CVE-2026-4360) are the standing deferrals for the Python
advisories on the embedded 3.13.15 interpreter, where no released fix exists.
Those deadlines are the only thing keeping the deferrals from becoming silent
permanent acceptances.

Add a repo-local check that fails when an exception file has passed its expires
date or carries a date that cannot be parsed, wired into the required
CI success (lint and unit tests) roll-up so it actually blocks. It should warn
ahead of expiry so the red is never a surprise.

Coordination ticket for the batch this comes out of:
https://github.com/StackVista/cve-reporter/issues/29

[ai-collaboration-app]

Status corrected In progress → In review during the 2026-08-29 dev-scan reconciliation: #501 is open with terminal green required checks and no review threads, so the work is awaiting review rather than still being written.

This matters to the CVE queue beyond this repository. cve-reporter#29 leaves five Python advisories on stackstate-k8s-agent that have no compatible patch, so their handling is a VEX statement or a dated exception; two of the existing exception files expire 2026-09-04 and three of the five advisories are unmanaged. Until #501 merges, nothing fails when an exception passes its expiry date.

[LouisLotter]

Follow-up fix pushed to #501. The checker now requires the evaluator's exact YYYY-MM-DD grammar, handles malformed document shapes cleanly, and runs ten checked positive/negative cases in CI. Exact-head lint/unit, binary, and DEB workflows are green:

• https://github.com/StackVista/stackstate-agent/actions/runs/33296650356
• https://github.com/StackVista/stackstate-agent/actions/runs/33296650359
• https://github.com/StackVista/stackstate-agent/actions/runs/33296650357