fix(image): trivy image cache writable by scanner user (0.3.3)

[nirmalgupta]

Summary

v0.3.2's image-scan lane was non-functional under the non-root `scanner` user. Every `trivy image` call failed with:

```
trivy image : exit 1: unable to initialize cache: unable to initialize fs cache:
failed to create cache dir: mkdir /var/cache/trivy/fanal: permission denied
```

The Dockerfile pre-cached the trivy DBs and `chmod -R a+rX`-ed the dir (read-only for non-root). `trivy fs` is fine — it reads but doesn't write. `trivy image` needs to create `fanal/` at runtime to cache extracted image layers, and `a+rX` blocks that mkdir.

Fix: `chown -R 1000:1000` instead of `chmod a+rX` — DBs remain readable; the scanner user can now create the runtime subdirs.

How it was caught

Fresh-dir end-to-end test of the ai-skills `security-scan` skill against v0.3.2. `trivy fs` ran clean; `image:unknown — trivy image python:3.14-slim — exit 1: ...permission denied` came back from the image lane.

Changes

• `Dockerfile`: chmod a+rX → chown -R 1000:1000.
• `SECURITY-SCAN-MANIFEST.yaml`: changelog entry; version 0.3.2 → 0.3.3.
• `pyproject.toml` + `init.py`: version bumps.

No Python code change. Tests unaffected (302 passed).

Test plan

• Full pytest suite still green.
• Republish 0.3.3 and re-run the fresh-dir test → expect `image:python:3.14-slim` to complete with findings instead of permission-denied.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes the container image’s Trivy cache permissions so trivy image works when the scanner runs as the non-root scanner user, and bumps the project/image version to 0.3.3 to reflect the release.

Changes:

• Make /var/cache/trivy writable by the scanner user by switching from chmod -R a+rX to chown -R 1000:1000.
• Bump version from 0.3.2 → 0.3.3 across the manifest and Python package metadata.
• Add a 0.3.3 changelog entry documenting the fix and rationale.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
Dockerfile	Adjusts Trivy cache ownership so trivy image can create runtime subdirectories under a non-root user.
SECURITY-SCAN-MANIFEST.yaml	Updates release metadata to 0.3.3, release date, and adds a detailed changelog entry.
security_scan/init.py	Updates __version__ to 0.3.3.
pyproject.toml	Updates [project].version to 0.3.3.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.