fix(factory): scan-image visibility — auto-notify on CVE detection with package details

## Context (companion to scan-image non-blocking change) ### Problem When scan-image finds CVEs today: - No visibility into WHICH CVE is blocking - No notification to anyone - No auto-filed issue with details - SARIF upload is best-effort and often fails silently - Nobody knows the factory is blocked until they check manually ### Requirements When a CRITICAL CVE is detected: 1. Parse Trivy JSON/SARIF output for: CVE ID, package name, installed version, fixed version (if any) 2. Auto-file issue in the affected repo with: - CVE details - Whether a fix is available upstream - Which image flavors are affected - Link to the build run 3. Label: priority/p0, area/security, kind/bug 4. If fix IS available: include the dnf update command or package pin 5. If fix is NOT available: note "upstream unfixed — monitor" ### Future (Option E) Once reliability is restored, re-add blocking scan at the :stable promotion gate only: - promote-testing-to-main checks Security tab for open CRITICAL CVEs - If found: blocks promotion, does NOT block :testing builds - This gives developers time to fix while testing keeps flowing ### Target Repos - projectbluefin/actions (reusable-build.yml post-scan step) _Filed by automation audit — P0 observability._