CI: record the paperless-ngx root init container as a documented exception

The pod runs rootless as uid/gid 1000; only init-run-ownership is root, to
chown the /run emptyDir that s6-overlay requires to be owned by the runtime
uid. Justified in paperless-ngx/values.yaml, so AVD-KSV-0105/-0022/-0106 are
excepted for that chart with the reason, instead of being reported as if the
workload itself ran as root.

ci/trivy/trivyignore.yaml

@@ -72,6 +72,21 @@ misconfigurations:
     paths: ["**/calibre-web-automated.yaml"]
     statement: "Same added capability set as AVD-KSV-0022; restricting it to NET_BIND_SERVICE would break the s6 init."
 
+  # --- paperless-ngx: the root init container ------------------------------
+  # Justified in paperless-ngx/values.yaml above its securityContext. The pod
+  # itself runs rootless as uid/gid 1000; only the init container is root.
+  - id: AVD-KSV-0105
+    paths: ["**/paperless-ngx.yaml"]
+    statement: "Only the init-run-ownership init container runs as uid 0: s6-overlay requires /run to be owned by the runtime uid (group-write is not enough), so it chowns the /run emptyDir before the hardened main container starts. The main container runs as 1000 with runAsNonRoot."
+
+  - id: AVD-KSV-0022
+    paths: ["**/paperless-ngx.yaml"]
+    statement: "The same init container drops ALL and adds back only CHOWN, which is the one capability its single chown call needs; it also keeps a read-only root filesystem and no privilege escalation."
+
+  - id: AVD-KSV-0106
+    paths: ["**/paperless-ngx.yaml"]
+    statement: "Same CHOWN-only capability set as AVD-KSV-0022; the check wants NET_BIND_SERVICE alone, which an init container that fixes file ownership cannot use."
+
   # --- homeassistant: deviations forced by the upstream image ---------------
   # All justified in homeassistant/values.yaml above its securityContext.
   - id: AVD-KSV-0012