CI: add dependency-vulnerability and container-image scanning (pip-audit + image scan)

[JumpTechCode]

Summary

CI has no dependency-vulnerability scanning and no container-image scanning. SAST on first-party code is covered (CodeQL + ruff's S/flake8-bandit ruleset), but third-party CVEs and the built image are unscanned.

Evidence

• .github/workflows/ci.yml + nightly-evals.yml — security-relevant steps are ruff lint (incl. S, pyproject.toml:86) and mypy; CodeQL runs via GitHub default setup. No pip-audit, no standalone bandit, no trivy/grype image scan.

Fix

• Add a pip-audit step against the locked deps (warn or fail on advisories).
• Add a container-image scan (Trivy/Grype) on the built image.
• Advisory-only at first is fine if green-CI gating is a concern.