fix(security): resolve TLS inventory in runtime image

apps/api/src/jobs/asset_scanner_job.py

@@ -1506,11 +1506,27 @@ def _build_domain_tls_inventory_assets(
     return [*domains.values(), *certificates.values()], relationships
 
 
+def _domain_tls_inventory_candidates(
+    *,
+    cwd: Path | None = None,
+    source_path: Path | None = None,
+) -> tuple[Path, ...]:
+    relative = Path("docs/security/domain-tls-certbot-inventory.snapshot.json")
+    source = (source_path or Path(__file__)).resolve()
+    roots = (cwd or Path.cwd(), *source.parents)
+    return tuple(dict.fromkeys(root / relative for root in roots))
+
+
 def _load_domain_tls_inventory_payload(path: Path | None = None) -> dict[str, Any]:
     if path is None:
-        relative = Path("docs/security/domain-tls-certbot-inventory.snapshot.json")
-        candidates = (Path.cwd() / relative, Path(__file__).resolve().parents[4] / relative)
-        path = next((candidate for candidate in candidates if candidate.is_file()), None)
+        path = next(
+            (
+                candidate
+                for candidate in _domain_tls_inventory_candidates()
+                if candidate.is_file()
+            ),
+            None,
+        )
     if path is None or not path.is_file():
         raise RuntimeError("domain_tls_inventory_snapshot_missing")
     if path.stat().st_size > 5_000_000: