* ci(security): add Semgrep CE and Trivy monitoring * fix(ci): diagnose Trivy coverage assertions * fix(ci): accept Trivy repository scan metadata * fix(ci): harden scanner failure diagnostics
* ci: harden release and add security scanning * Harden release and deploy recovery paths * Fix npm artifact pack destinations