New scan step between build and push: the built image is exported and
scanned with Trivy; fixable HIGH/CRITICAL findings fail the action and
block the push. Configurable via new scan / scan-severity inputs.
Implements noctrl.podman security review finding #16 (CI level).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
peetandClaude Fable 5