fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies

- Override glob>=10.5.0 (CVE-2025-64756 command injection)
- Override minimatch>=9.0.6 (CVE-2026-26996/27903/27904 ReDoS)
- Override tar>=7.5.11 (CVE-2026-23745/23950/24842/26960/29786/31802
  path traversal and arbitrary file overwrite)
- picomatch>=4.0.4 already overridden (CVE-2026-33671 ReDoS)
- Add .trivyignore for pnpm 9.x CVEs (CVE-2025-69262/69263) that
  require a major version bump to pnpm 10.x
- Restore Trivy as a blocking gate with trivyignore support
- Restore scan dependency in manifest job

.github/workflows/release.yml

@@ -277,14 +277,21 @@ jobs:
           sha=$(ls /tmp/digests | head -1)
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
+      - name: Checkout for trivyignore
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: .trivyignore
+          sparse-checkout-cone-mode: false
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: "ghcr.io/snapotter-hq/snapotter@sha256:${{ steps.digest.outputs.sha }}"
           format: "table"
-          exit-code: "0"
+          exit-code: "1"
           ignore-unfixed: true
           severity: "CRITICAL,HIGH"
+          trivyignores: ".trivyignore"
 
       - name: Upload results to GitHub Security
         if: always()
@@ -304,7 +311,7 @@ jobs:
 
   manifest:
     name: Create Multi-Arch Manifests
-    needs: [release, docker]
+    needs: [release, docker, scan]
     runs-on: ubuntu-latest
     permissions:
       contents: read