fix(build): correct trivy fallback condition to rely on sbom scan

Author: snowdream

.unirtm.toml

@@ -142,12 +142,10 @@ if [ "${CI:-}" = "true" ] || [ "${GITHUB_ACTIONS:-}" = "true" ]; then
     unirtm exec -- trivy fs --format cyclonedx --output sbom.json .
     unirtm exec -- trivy sbom sbom.json
 else
+    unirtm exec -- trivy fs --format cyclonedx --output sbom.json .
     # Try offline mode first. If missing DB, it will fail and we fallback to online.
-    if unirtm exec -- trivy fs --skip-db-update --skip-java-db-update --skip-check-update --offline-scan --format cyclonedx --output sbom.json . >/dev/null 2>&1; then
-        unirtm exec -- trivy sbom --skip-db-update --skip-java-db-update --offline-scan sbom.json
-    else
+    if ! unirtm exec -- trivy sbom --skip-db-update --skip-java-db-update --offline-scan sbom.json; then
         echo "⚠️  Local Trivy DB missing. Downloading from AWS ECR fallback..."
-        unirtm exec -- trivy fs --format cyclonedx --output sbom.json .
         unirtm exec -- trivy sbom sbom.json
     fi
 fi