feat(lab10): DefectDojo governance report + capstone walkthrough

[prudenz1]

Goal

Capstone: aggregate Labs 4–9 scan outputs in DefectDojo, apply SLA matrix, compute program metrics, and produce a 5-minute interview walkthrough.

Changes

• submissions/lab10.md — DefectDojo setup, import table, dedup proof (CVE-2024-37890), governance report
• submissions/lab10-walkthrough.md — timed 5-minute DevSecOps program script + Q&A

Testing

cd labs/lab10/work/dd && ./docker/setEnv.sh release && docker compose up -d
# Import scans via API (Grype, Trivy, Semgrep, Checkov, KICS)
python manage.py dedupe --dedupe_only --dedupe_sync

Observed: 379 raw findings → 331 after dedup; CVE-2024-37890 merged across two Trivy imports (finding 210 canonical).

Artifacts

• submissions/lab10.md
• submissions/lab10-walkthrough.md

---

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/labN.md exists

---

Lab 10 Progress

• Task 1 — DefectDojo setup + imports + dedup proof
• Task 2 — Governance report with MTTD/MTTR/SLA/backlog
• Bonus — 5-minute walkthrough script with timed practice