Use docker-archive for the Trivy scan export (oci-archive unsupported)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

podman-build-publish/action.yaml

@@ -178,10 +178,11 @@ runs:
         first_tag="$(printf '%s\n' "${{ inputs.tags }}" | tr ', ' '\n\n' | sed '/^$/d' | head -n1)"
 
         # Trivy cannot read podman's storage under a custom --root, so scan
-        # an exported archive of the image instead.
+        # an exported archive instead. Must be docker-archive: trivy's
+        # --input does not understand oci-archive tarballs (verified).
         archive="${RUNNER_TEMP}/trivy-scan-image.tar"
         rm -f "${archive}"
-        podman "${podman_args[@]}" save --format oci-archive -o "${archive}" "${image_base}:${first_tag}"
+        podman "${podman_args[@]}" save --format docker-archive -o "${archive}" "${image_base}:${first_tag}"
 
         echo "Scanning ${image_base}:${first_tag} (fail on: ${{ inputs.scan-severity }}, fixed only)"
         trivy image \