Maintenance: Sync latest template repo upstream

[m-houston]

Description

Pull in upstream changes from the repo template and reconcile with local repo config.

Context

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[Copilot]

Pull request overview

Syncs this repository with upstream changes from the NHS Notify repository template, updating build/dev tooling, CI workflows, and repo scaffolding to match the latest template conventions.

Changes:

• Introduces/updates Terraform, Docker, and Trivy helper scripts/Make targets aligned to the template.
• Updates GitHub workflows/actions and pre-commit hooks (including new TODO enforcement).
• Refreshes JS/tooling configuration (Sonar properties, ESLint rule tweak, dependency bumps) and removes the example lambda scaffolding.

Reviewed changes

Copilot reviewed 40 out of 44 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
src/jekyll-devcontainer/Makefile	Adds devcontainer build/publish/debug targets for the Jekyll devcontainer.
scripts/terraform/trivy-scan.sh	Adds a Trivy wrapper supporting native vs Docker execution.
scripts/terraform/terraform.mk	Replaces Terraform make targets with TFScaffold-oriented operations plus fmt/validate helpers.
scripts/init.mk	Adjusts dependency install loop to use $(MAKE) for recursion.
scripts/githooks/check-todos.sh	Adds a git hook script to enforce TODO usage (with Jira ticket filtering).
scripts/githooks/check-terraform-format.sh	Updates terraform formatting hook to call terraform-fmt / terraform-fmt-check targets.
scripts/githooks/check-file-format.sh	Switches native formatter command to editorconfig-checker.
scripts/git-repo/branch-protection.sh	Updates branch protection ruleset payload to include required status checks.
scripts/git-repo/auto-link.sh	Adjusts Jira autolink creation payload.
scripts/docker/docker.mk	Replaces Docker targets with NHS Notify container build/push/login workflow for ECR/GHCR.
scripts/docker/docker.lib.sh	Adds NHS Notify-specific container helpers (ECR/GHCR login, container build/push, image naming).
scripts/config/vale/styles/config/vocabularies/words/accept.txt	Expands accepted vocabulary for Vale checks.
scripts/config/trivy.yaml	Extends Trivy config skip list to include node_modules.
scripts/config/sonar-scanner.properties	Re-points Sonar sources/tests configuration to packages/ and adjusts coverage/test patterns.
scripts/config/pre-commit.yaml	Bumps pre-commit-hooks rev and adds a local TODO enforcement hook; adjusts JSON formatting exclusions.
scripts/config/.repository-template-sync-merge	Adds workflow glob to files merged during template sync.
scripts/config/.repository-template-sync-ignore	Expands template sync ignore list for repo-specific files/paths.
package.json	Updates dev dependencies, adds an override, and removes lambdas workspace / root start script.
package-lock.json	Regenerates lockfile for updated deps/workspaces.
lambdas/example-lambda/tsconfig.json	Removes example lambda scaffold file.
lambdas/example-lambda/src/index.ts	Removes example lambda handler.
lambdas/example-lambda/src/tests/index.test.ts	Removes example lambda unit test.
lambdas/example-lambda/package.json	Removes example lambda package definition/scripts.
lambdas/example-lambda/jest.config.ts	Removes example lambda Jest config.
lambdas/example-lambda/.gitignore	Removes example lambda ignore rules.
lambdas/example-lambda/.eslintignore	Removes example lambda ESLint ignore file.
infrastructure/terraform/bin/terraform.sh	Updates pre.sh invocation style, asdf plugin command, and backend config generation.
eslint.config.mjs	Tightens no-relative-import-paths rule from off to error.
AGENTS.md	Rewrites agent guidance to match newer template structure and repo layout notes.
.github/workflows/stage-3-build.yaml	Removes TODO markers from placeholder workflow steps.
.github/workflows/stage-1-commit.yaml	Adds TODO usage check job; adds ASDF setup for terraform linting; includes commented Trivy stubs.
.github/workflows/scorecard.yml	Updates checkout pin and enables additional permissions/token configuration.
.github/workflows/release_created.disabled	Adds a disabled release workflow template.
.github/workflows/pr_destroy_dynamic_env.disabled	Adds a disabled PR environment destroy workflow template.
.github/workflows/pr_create_dynamic_env.disabled	Adds a disabled PR environment create workflow template.
.github/workflows/pr_closed.disabled	Adds a disabled PR-closed deploy workflow template.
.github/scripts/dispatch_internal_repo_workflow.sh	Adds a script to dispatch and wait for a workflow run in nhs-notify-internal.
.github/actions/trivy-package/action.yaml	Adds a commented-out composite action stub for Trivy package scanning.
.github/actions/trivy-iac/action.yaml	Adds a commented-out composite action stub for Trivy IaC scanning.
.github/actions/lint-terraform/action.yaml	Updates terraform lint action to install terraform with asdf and validate via terraform-validate-all.
.github/actions/check-todo-usage/action.yaml	Adds composite action wrapper for the TODO usage hook.
.github/SECURITY.md	Updates contact emails to mailto links and replaces placeholder address.
.github/PULL_REQUEST_TEMPLATE.md	Adds a commented note referencing skip-trivy-package label usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[m-houston]

Reverted branch to 99f8bec as this was the last reviewed commit. Will merge this (matches upstream) and apply proposed Copilot changes in a PR to the repository template.