Runs a ClamAV daemon (clamav/clamav:1.4.6) in both compose stacks and the Helm chart, health-gated, with a verify-clamav check (EICAR found, clean OK) in verify-stack. ADR-0036 records the scan-in-domain, fail-closed decision (#190).
closes#191
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
