ci: Vulnerability Check fails repo-wide on four new github.com/lib/pq advisories

`make vulncheck` started failing on every branch today. It is not caused by any change in flight.

Four advisories against `github.com/lib/pq` were published on **2026-08-18T16:38Z**:

| ID | Summary |
|---|---|
| GO-2026-6173 | Pre-protocol error reader permits unbounded memory consumption |
| GO-2026-6172 | Backend frame lengths cause pre-validation memory exhaustion |
| GO-2026-6171 | Malformed RowDescription and DataRow messages cause panics |
| GO-2026-6170 | Malformed backend frame length causes panic |

All four are `introduced: 1.11.0` with **no fixed version** — `Fixed in: N/A`. We are on `v1.12.3`.

Reachable through the inventory components:

```
internal/inventory/viewer/execute.go:55: viewer.Execute -> sql.OpenDB -> pq.Connector.Connect
internal/inventory/aggregator/database.go:156: aggregator.UpsertNeighbors -> sql.Tx.Commit -> pq.conn.*
```

Confirmed present on `origin/main` — I ran govulncheck against a clean worktree of it, so this is not specific to any PR. main's last CI run (14 Aug, `acb37bcc`) predates the advisories and passed.

Since there is no fixed release to move to, the options are roughly:

- assess exploitability for our use. All four are about a hostile or corrupted **server** response; if the aggregator and viewer only ever talk to a Postgres we control on a trusted network, the practical exposure is limited, which would justify recording a `govulncheck` suppression with that reasoning and a link to this issue.
- move off `lib/pq` to `jackc/pgx`, which is the actively maintained driver.
- vendor a patch until upstream fixes it.

Whichever way it goes, CI is red for everyone until it is decided, so the suppression is probably needed first regardless.

Start by reproducing the failure with `make vulncheck` and inspect the reachable paths in `internal/inventory/viewer/execute.go` and `internal/inventory/aggregator/database.go`. Assess the four advisories against the trusted-server usage described, then determine whether suppression, migration to `jackc/pgx`, or a vendor patch is appropriate. Done means the decision is recorded and CI is no longer red.

Written by the indexing model from the issue text.