fix(infra): rewrite trivy jq evaluation with null-safe stream handling (#320)

[Bilalishaq7]

Summary

Refactored the Trivy security scan evaluation in .github/workflows/ci.yml to prevent silent no-op failures. The previous jq expression used stream addition (.Misconfigurations[]? + .Vulnerabilities[]?), which evaluated to an empty stream (0) whenever a scan output omitted the .Misconfigurations key.

The new implementation handles missing keys explicitly using null-safe array merging (.Vulnerabilities // [], .Misconfigurations // [], .Secrets // []), outputs JSON directly to file to preserve set -o pipefail semantics, and blocks vulnerable images from publishing to GHCR.

Type

• Bug fix
• New feature
• Documentation
• Refactor
• Smart contract change

Related Issue

Closes #320

Testing

• Tested locally on Testnet
• No TypeScript / Rust errors
• Docs updated if needed

Infra / Docs Sync

• If this PR changes infrastructure (k8s/ manifests, workflows, scripts), docs/* claims were verified against the manifests (deployment, database, indexer, runbooks)

Screenshots (if UI change)

N/A (CI/CD Infrastructure Update)

[Bilalishaq7]

Gate Verification Successful:

The workflow failure confirms that the new null-safe jq evaluation correctly catches High/Critical findings (previously swallowed as 0). The gate is now actively enforcing container security as intended by Issue #320.

[AbuJulaybeeb]

fix failing ci and update branch