Add container vulnerability scanning and SBOM generation in CI

Parent issue: #64

Scope:
- Add image scanning (e.g., Trivy) to CI
- Define fail thresholds for HIGH/CRITICAL CVEs
- Generate SBOM artifacts for built images

Acceptance criteria:
- CI job runs on PRs touching image/runtime files
- Build fails on configured severity thresholds
- SBOM artifact is attached or persisted in workflow artifacts