Trivy: use GHCR DB source, add ECR fallback, update codeql-action to v4 (#22)

## Summary

Fixes the post-merge pipeline failure from PR #20 where
`mirror.gcr.io/aquasec/trivy-db` returned 404, preventing `v2.5.2` from
being published.

- **Trivy DB primary + fallback**: Sets
`TRIVY_DB_REPOSITORY=ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db`
on all four Trivy steps. Trivy tries GHCR first, falls back to AWS ECR
Public if unavailable, before failing.
- **`codeql-action/upload-sarif` v3 → v4**: Addresses the deprecation
warning logged during the failed run (v3 deprecated December 2026).

## Test plan

- [ ] Post-merge `scan` job completes successfully with Trivy DB
downloaded from GHCR
- [ ] SARIF uploaded to Security tab
- [ ] `merge` job runs and v2.5.2 tags published correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Paradoxbound <paradoxbound@paradoxbound.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

.github/workflows/docker-publish.yml

@@ -146,6 +146,8 @@ jobs:
 
       - name: Scan image for vulnerabilities (Trivy)
         uses: aquasecurity/trivy-action@0.30.0
+        env:
+          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
         with:
           image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest-amd64
           format: sarif
@@ -155,7 +157,7 @@ jobs:
           exit-code: '0'
 
       - name: Upload Trivy SARIF to Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: trivy-release.sarif
@@ -165,6 +167,8 @@ jobs:
       # from the SARIF step above (trivy-action exports env vars that persist
       # across steps; a second trivy-action invocation cannot fully override them).
       - name: Fail release on CRITICAL vulnerabilities
+        env:
+          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
         run: |
           trivy image \
             --format table \
@@ -489,6 +493,8 @@ jobs:
       # CRITICAL findings fail the PR check; HIGH are informational only.
       - name: Scan PR image for vulnerabilities (Trivy)
         uses: aquasecurity/trivy-action@0.30.0
+        env:
+          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
         with:
           image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ github.event.pull_request.number }}-amd64
           format: sarif
@@ -498,7 +504,7 @@ jobs:
           exit-code: '0'
 
       - name: Upload Trivy SARIF to Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: trivy-pr.sarif
@@ -508,6 +514,8 @@ jobs:
       # from the SARIF step above (trivy-action exports env vars that persist
       # across steps; a second trivy-action invocation cannot fully override them).
       - name: Fail PR on CRITICAL vulnerabilities
+        env:
+          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
         run: |
           trivy image \
             --format table \