ci: force latest trivy version in scans (#841)

* fix(docker): upgrade CLI to v29.4.1 and Compose to v5.1.3, clear VEX

* fix(vex): restore CVE-2026-34040 not_affected statement for compose

* fix: correct VEX product matching for CVE-2026-34040

* ci: specify trivy-version latest to resolve CVE-2026-34040 false positive

.github/workflows/ci.yml

@@ -164,6 +164,7 @@ jobs:
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
           format: 'table'
+          trivy-version: 'latest'
           trivy-config: trivy.yaml
 
       # Mirror of the release-time pre-publish smoke gate in docker-publish.yml.

.github/workflows/docker-publish.yml

@@ -112,6 +112,7 @@ jobs:
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
           format: 'table'
+          trivy-version: 'latest'
           trivy-config: trivy.yaml
 
       # Start the scanned image headless on the runner and poll /api/health