fix: create CVE notifications during scan, fix help chat doc loading

Bug fixes:

1. CVE notifications now created during scan pipeline (not just hourly)
   - Previously, notifications were only created by the scheduled
     monitor_cves job. Users with 4 CVE alerts saw 0 notifications.
   - Now the scan pipeline (Stage 3) creates notifications immediately
     when CVE alerts are discovered, with the same dedup logic.

2. Help chat doc context loading fixed for Docker/production
   - Added HELP_DOCS_PATH env var for explicit doc root configuration
   - Added fallback chain: env var → binary location → cwd → Docker paths
   - Dockerfile.agent now copies README.md and docs/ into /app and sets
     HELP_DOCS_PATH=/app so the help chat has doc context in production

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dockerfile.agent

@@ -33,6 +33,11 @@ RUN pip3 install --break-system-packages ruff
 
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
 
+# Copy documentation for the help chat assistant
+COPY --from=builder /app/README.md /app/README.md
+COPY --from=builder /app/docs /app/docs
+ENV HELP_DOCS_PATH=/app
+
 # Ensure SSH key directory exists
 RUN mkdir -p /data/compliance-scanner/ssh