chore(ci): unblock the CVE gate, finish Sonnet 5, parallelize, harden the supply chain (#1223)

Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override).

Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly.

Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure.

40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run).

Full details in the PR body.

.github/workflows/pr-agent.yml

@@ -64,15 +64,25 @@ jobs:
           # ── Model: Claude Sonnet 5 via the EU Bedrock inference profile. The
           #    strong and weak slots both point at it: this account has no larger
           #    model enabled, so a second id would only be the same model under
-          #    another name. No FALLBACK_MODELS for the same reason: a fallback
-          #    list naming the primary is not a fallback. custom_model_max_tokens
-          #    is required because this id is not in PR-Agent's built-in map.
+          #    another name. custom_model_max_tokens is required because this id
+          #    is not in PR-Agent's built-in map.
           CONFIG.MODEL: "bedrock/eu.anthropic.claude-sonnet-5"
           CONFIG.MODEL_WEAK: "bedrock/eu.anthropic.claude-sonnet-5"
-          CONFIG.CUSTOM_MODEL_MAX_TOKENS: "200000"
+          # Emptied explicitly. This block previously said it set no fallback
+          # list, but "unset" is not "none": PR-Agent's own default is
+          # ["gpt-5.6-terra"], visible in the resolved config it logs on every
+          # run. Only AWS credentials reach this container, so that fallback
+          # could never have authenticated, but a silent third-party model in
+          # the path of every PR diff should be absent by intent, not by a
+          # missing key.
+          CONFIG.FALLBACK_MODELS: "[]"
+          CONFIG.CUSTOM_MODEL_MAX_TOKENS: "1000000"
           # Input window PR-Agent prunes the diff to fit. Default (~32k) truncated
           # large PRs; raise it so the whole diff is reviewed (Sonnet 5 = 1M ctx).
-          CONFIG.MAX_MODEL_TOKENS: "64000"
+          # 64000 was tuned against Sonnet 4.6's tokenizer. Sonnet 5 tokenizes the
+          # same text into roughly 30% more tokens, so that budget silently held
+          # ~30% less real diff after #1218; 96000 restores parity with headroom.
+          CONFIG.MAX_MODEL_TOKENS: "96000"
           LITELLM.DROP_PARAMS: "true"
 
           # ── pr_actions = which GitHub PR *event actions* trigger the bot