security: eliminate warning-class output from central Security Scan

[seonghobae]

Evidence

Current-head Naruon PR #1206 run 30637062852 completed with zero Medium-or-higher findings, but the central Security Scan log still contains strict-contract warning/fatal-class output:

• Trivy: [pip] Unable to find python site-packages directory. License detection is skipped.
• OSV Scanner v2.3.8: --output is deprecated in favor of --output-file for base/head scans.
• OSV Reporter v2.3.8: --output is deprecated in favor of --output-files.
• SARIF upload: local git attribution first emits fatal: bad object <synthetic merge sha> before falling back to server-side calculation.

The actual scan evidence was clean: Trivy 0 CRITICAL/HIGH/MEDIUM, dependency-review 0 moderate+, OSV reporter SARIF 0, open code-scanning alerts 0. This issue tracks log-contract remediation rather than a package/CVE finding.

Acceptance

• Replace deprecated OSV flags with their v2 forms.
• Run Trivy with its supported quiet/log-suppression input while retaining required SARIF output and the explicit parser that prints every Medium+ finding.
• Materialize and verify the PR synthetic merge object before SARIF upload so attribution does not emit handled fatal output.
• Add regression assertions and validate the reusable workflow with actionlint plus focused/full tests.
• Prove the change on a downstream current-head canary log.

[seonghobae]

Codex started the central warning-free Security Scan remediation on 2026-08-01 10:45 KST from exact downstream evidence in ContextualWisdomLab/naruon#1206. Project status: In Progress; Phase: Ops; Component: dot-github.

[seonghobae]

Implemented in #690 at current head 69ac38fe53ab7ba831c5bf7460373bab8e54ec79.

Live required-workflow canary: Security Scan run 30679412515.

• OSV base/head: 0 findings / 0 findings
• exact receipt: Verified synthetic merge attribution commit before OSV SARIF upload.
• OSV SARIF upload: success; no upload runtime failures
• Trivy: INPUT_HIDE_PROGRESS=true, scanners remain vuln,secret,misconfig, job success
• runtime search: no deprecated-output warning, pip license warning, or fatal: bad object; the only matched historical phrases were quoted in the PR description
• current-head pip-audit, dependency-review, OSV, Trivy, Bandit, Semgrep, CodeQL, and Gitleaks are green

Local verification remains 796/796 tests, 100% statement coverage, 100% docstrings, plus 0 OSV/Trivy/Gitleaks findings.