Publish saelix/sencho:pr-N and preview-sha from open PRs. Uses Trivy and smoke gates matching the integration build.