fix(actions): change scan-image to non-blocking + auto-file issue on CVE detection

## 🔴 P0 — Scan-image CVE gate is the #1 cause of factory unreliability ### Root Cause The reusable-build.yml scan-image step uses: ```yaml exit-code: ${{ github.event_name == 'pull_request' && '0' || '1' }} ``` On push builds, ANY critical CVE blocks the entire pipeline. This cascades: - Build "fails" (image was built successfully but scan gate kills the run) - E2E skipped (no "successful" image to test) - Release gate blocks (E2E not green) - Promote fails (gate says "not ready") - No release ships **One upstream CVE advisory halts the ENTIRE factory.** ### Current Impact - bluefin build success rate: 55% - bluefin-lts build success rate: 40% - bluefin promote success rate: 10% (85% failure!) - All failures trace back to scan-image blocking ### Decision Change to **Option D**: scan reports but does NOT block. On CVE detection: 1. Change exit-code to 0 for ALL events (testing images) 2. Auto-file a P0 issue with CVE details (package, CVE ID, severity, fix-available?) 3. SARIF still uploads to Security tab 4. Image publishes to :testing regardless 5. Future: tighten to blocking for :stable promotion (Option E) ### Implementation 1. In reusable-build.yml: change exit-code to always `0` 2. Add post-scan step: if Trivy found CRITICAL CVEs, parse SARIF and auto-file issue 3. Ensure SARIF upload always runs (already has `if: always()`) 4. Later: add blocking gate back at promote-testing-to-main level only ### Target Repos - projectbluefin/actions (reusable-build.yml, scan-image action) _Filed by automation audit — P0 reliability. Design decision: Option D approved._