UID2-7619: suppress CVE-2026-69152 in .trivyignore (#203)

* UID2-7619: suppress CVE-2026-69152 in .trivyignore (exp 2026-09-06)

unknown package is present but not reachable from this service — see UID2-7619 for the impact assessment. Reachability alone determines suppress-vs-fix.

* extend suppression window to 3 months (exp 2026-11-06)

Author: swibi-ttd

.trivyignore

@@ -35,3 +35,10 @@ CVE-2026-26996 exp:2027-02-20
 #
 # Expires: 2027-02-20 — revisit when eslint-plugin-import or ESLint is upgraded.
 CVE-2026-14257 exp:2027-02-20
+
+# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH).
+# Not exploitable here: yarn.lock brace-expansion 1.1.16/2.1.2/5.0.7 all via devDependencies
+# (eslint-plugin-import->minimatch@3, jest/eslint tooling, nodemon->minimatch@10); existing
+# .trivyignore documents devDependency-only, not runtime-reachable
+# See: UID2-7619
+CVE-2026-69152 exp:2026-11-06