#2862 [comp] Production Deploy

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Deploys the cloud-tests auditor visibility improvements: clearer evidence, per-check descriptions, grouping, comments on findings, and a new History tab; also fixes background-check exemptions to persist reason/justification and tightens “Fix All” to failed-only with stricter exception expiry parsing.

• New Features

  • Evidence viewer on each result with server-side redaction of secrets; copy-to-clipboard.
  • “About this check” panel: AWS checks get a cached Tier 3 description (what/pass/fail/why); GCP/Azure derive descriptions from provider evidence; forbidden control IDs/URLs stripped.
  • Results grouped by check within each service (by checkKey) with “X of Y failing”, display caps, and a renamed “Scan Results” tab; remediation text parsed into steps, reference link, and compliance chips; safer reference URLs.
  • Exceptions and History: mark exceptions with a required reason (20+ chars), optional reviewer, and optional expiry; reconciliation writes FindingResolution/Regression; History tab shows summaries, active exceptions, regressions, and supports revoke.
  • Comments on findings: new finding entity type and an entity-aware permission guard; thread shown on the finding detail sheet.
  • Polish: “Fix All” now targets failed findings only; exception expiry enforces timezone on full ISO timestamps (bare YYYY-MM-DD still expands to end-of-day UTC); stricter, case-insensitive strip of control citations in check descriptions.

• Migration

  • Adds DB tables and fields for check definitions and history: CheckDefinition, FindingException, FindingResolution, FindingRegression; plus scannedServices/failedServices on IntegrationCheckRun and CommentEntityType.finding.
  • Adds backgroundCheckExemptReason and backgroundCheckExemptJustification on Member; persisted when exempt is true and cleared when set to false.