[SandObserver]

Summary

• Remove .github/workflows/vex.yml and the vex job in release.yml that called it.
• Remove .github/vex/stackyard.vex.json, the dockerhub output of build-and-push that only the vex job read, and the VEX tests in release-workflow.test.js.
• Docker Scout loads the document but does not suppress CVE-2026-107891 for any product form, on scout-cli 1.26.0 and 1.28.0. The job passed the Docker Hub write token to Scout for no effect.

Testing
All green.

Changelog

Removed

• Stop attaching a not-affected statement for CVE-2026-107891 to Docker Hub images.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.