docs: refresh inventory after closing #147–#151 and #145

[toddysm]

Summary

Follow-up to the bootstrap inventory (#223). Now that the stale issues are closed, removes the "Vuln-attestation wiring issues open despite merged code" gap note from docs/project-state.md.

Context

• scan-image: emit a cosign-vuln in-toto vulnerability attestation #147–Docs: document the vulnerability-attestation scan-report referrer #151 closed as completed (the end-to-end wiring landed in PR feat(catalog): vulnerability-attestation scan-report referrer #152, merged 2026-07-10). The capability is already recorded under the Implemented vuln-attestation row.
• Supply-chain graph: index image flow with Kùzu (embedded graph store) #145 closed as superseded by LadybugDB; it remains recorded under Deferred / Won't do.

No other rows change.

[Copilot]

🟢 Approval recommended

The change is a straightforward documentation cleanup that preserves valid Markdown structure and matches the stated PR intent.

Pull request overview

This PR updates the project capability inventory documentation by removing a now-stale “Known gaps & debt” note about vuln-attestation wiring issues remaining open after the implementation landed, aligning docs/project-state.md with the current issue/PR status described in the PR metadata.

Changes:

• Removes the “Vuln-attestation wiring issues open despite merged code” gap entry now that #147–#151 are closed.
• Keeps the rest of the inventory unchanged (no row/status reshuffles).

File summaries

File	Description
docs/project-state.md	Removes an outdated “Known gaps & debt” note about vuln-attestation wiring issues being open despite merged implementation.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.