fix(docker): upgrade CLI to v29.4.1 and Compose to v5.1.3, clear VEX (#836)

* fix(docker): upgrade CLI to v29.4.1 and Compose to v5.1.3, clear VEX

* fix(vex): restore CVE-2026-34040 not_affected statement for compose

* fix: correct VEX product matching for CVE-2026-34040

.github/workflows/ci.yml

@@ -154,14 +154,10 @@ jobs:
       - name: Scan image for vulnerabilities (Trivy)
         # Hard-fails the PR on any HIGH or CRITICAL finding not suppressed by
         # the OpenVEX document at security/vex/sencho.openvex.json (loaded via
-        # trivy.yaml) or by .trivyignore at the repo root. The VEX document is
-        # the canonical triage record and is also attached as a cosign
-        # attestation on the published image. .trivyignore exists only to
-        # mirror VEX entries that cannot be resolved here because Trivy does
-        # not emit an OCI purl for local images without a digest, so VEX
-        # product matching against `sencho:pr-test` is a no-op (see
-        # aquasecurity/trivy#9399). Add the VEX statement first, then mirror
-        # the CVE id in .trivyignore with a pointer to the VEX justification.
+        # trivy.yaml). The VEX document is the canonical triage record and is
+        # also attached as a cosign attestation on the published image.
+        # If a new CVE must be triaged, add a VEX statement with a
+        # justification — do NOT recreate .trivyignore.
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: sencho:pr-test