Run reproducible Trivy gates for maintained images

[prazgaitis]

Summary

Replace the Trivy setup action with the digest-pinned Trivy 0.66 container. The setup action's nested installer exited before the binary reached PATH, so the first image build completed but no scan ran.

The replacement:

• scans the exact multi-arch manifest digest for both linux/amd64 and linux/arm64;
• records complete High/Critical JSON evidence for each platform;
• derives the Critical gate from those same reports, avoiding a second scan with a different database state;
• emits a remediation-bearing error and prevents signing whenever Critical findings exist;
• shares a per-job vulnerability database cache between the two platform scans.

Validation

• Workflow YAML parses locally and passes git diff --check.
• The Trivy image is pinned to the verified v0.66.0 multi-arch manifest digest already used for local candidate scans.