ci(trivy): add artifact and PR configuration scans

[alangou]

Summary

Add Trivy coverage for published release artifacts and a differential pull-request gate for Helm and Dockerfile configuration. The PR check blocks only newly introduced High or Critical findings, so existing security debt remains visible without blocking unrelated changes.

Related Issue

Part of #2988.

Changes

• Add a reusable workflow for multi-architecture image scans, deployment configuration scans, and packaged OCI Helm chart scans
• Add a pull-request and merge-group workflow that compares baseline and candidate findings and publishes the stable OpenShell / Trivy Changes result
• Keep scanner failures distinct from findings and retain JSON, SARIF, summaries, and workflow artifacts
• Add narrowly path-scoped false-positive exceptions plus Trivy and Helm to the Nix development shell
• Document release and PR scan behavior, required status configuration, and Gator gate awareness

After this lands and the check has run once, repository administrators must add OpenShell / Trivy Changes to the required checks in the main ruleset.

Testing

• mise run pre-commit passes
• Actionlint passes for both Trivy workflows
• Differential gate cases cover unchanged findings, new High/Critical findings, below-threshold findings, and malformed reports
• Manual Trivy scans covered repository configuration, the packaged OCI chart, and multi-architecture images
• Unit tests added/updated (not applicable: CI and shell tooling only)
• E2E tests added/updated (not applicable: no runtime behavior change)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)