chore(ci): unblock the CVE gate, finish Sonnet 5, parallelize, harden the supply chain (#1223)

Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override).

Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly.

Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure.

40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run).

Full details in the PR body.

.github/workflows/compliance-pr.yml

@@ -23,11 +23,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
-      - uses: erp-mafia/compliancemaxx@v2
+      - uses: erp-mafia/compliancemaxx@248cebcf90867fa813a8c0a2bc66cca70a56db3a # v2
         with:
           base: ${{ github.event.pull_request.base.sha }}
           fail-on-findings: false           # advisory while bedding in
@@ -35,3 +35,10 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: eu-north-1
+          # Pin the review model explicitly. compliancemaxx falls back to
+          # `eu.anthropic.claude-sonnet-4-6` when this is unset
+          # (packages/cli/src/llm/bedrock.ts), so leaving it out silently kept
+          # this workflow a generation behind the rest of the repo after the
+          # Sonnet 5 migration (#1218). Keep in sync with
+          # swedish-compliance-review.yml and lib/agent/composer/client.ts.
+          COMPLIANCE_BEDROCK_MODEL: eu.anthropic.claude-sonnet-5