fix(release): run trivy from a pinned verified binary (#1)

trivy-action checks its own repository out of github.com using the runner
token; on this self-hosted Gitea that token is a Gitea token, GitHub answers
"Bad credentials", and both scan steps die before trivy is installed.

Download the v0.69.3 release archive directly, verify it against a sha256
digest pinned inline, and unpack only the binary into .release-work/bin,
which is gitignored and excluded from the Docker build context. The gate
keeps its exact semantics: --exit-code 1, --severity HIGH,CRITICAL, table
output, unfixed vulnerabilities still in scope. The SPDX step writes the
same filename release_artifacts.py normalize-container-sbom consumes, and
TRIVY_CACHE_DIR keeps the vulnerability DB inside the work directory.

tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs

@@ -86,8 +86,25 @@ public sealed class ReleaseCompatibilityTests
         Assert.DoesNotContain("skip-duplicate", workflow, StringComparison.OrdinalIgnoreCase);
         Assert.Contains("check-compatibility.sh", workflow, StringComparison.Ordinal);
         Assert.Contains("--platform linux/amd64", workflow, StringComparison.Ordinal);
-        Assert.Contains("ignore-unfixed: false", workflow, StringComparison.Ordinal);
-        Assert.Contains("format: spdx-json", workflow, StringComparison.Ordinal);
+        Assert.DoesNotContain("aquasecurity/trivy-action", workflow, StringComparison.Ordinal);
+        Assert.Contains(
+            "https://github.com/aquasecurity/trivy/releases/download/v0.69.3/trivy_0.69.3_Linux-64bit.tar.gz",
+            workflow,
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "1816b632dfe529869c740c0913e36bd1629cb7688bd5634f4a858c1d57c88b75",
+            workflow,
+            StringComparison.Ordinal);
+        Assert.Contains("sha256sum --check --strict", workflow, StringComparison.Ordinal);
+        Assert.Contains("TRIVY_CACHE_DIR=$RENDEZVOUS_WORK_DIR/trivy-cache", workflow, StringComparison.Ordinal);
+        Assert.Contains("--exit-code 1", workflow, StringComparison.Ordinal);
+        Assert.Contains("--severity HIGH,CRITICAL", workflow, StringComparison.Ordinal);
+        Assert.DoesNotContain("--ignore-unfixed", workflow, StringComparison.Ordinal);
+        Assert.Contains("--format spdx-json", workflow, StringComparison.Ordinal);
+        Assert.Contains(
+            "--output \"$RENDEZVOUS_RELEASE_DIR/FinalFactory.Rendezvous.Container.$RENDEZVOUS_VERSION.spdx.json\"",
+            workflow,
+            StringComparison.Ordinal);
         Assert.Contains("normalize-container-sbom", workflow, StringComparison.Ordinal);
         Assert.Contains("finalize-release-candidate.sh", workflow, StringComparison.Ordinal);
         Assert.Contains("verify-real-consumers.sh", workflow, StringComparison.Ordinal);