The CEL scanner only works through TailoredProfile today. We need to add a Profile path so shipped CEL content can be scanned directly, and update the relevant controllers (TP, SSB, ComplianceScan) and RBAC accordingly.