0.0.3

fix: use image digest for SBOM and security scanning

Instead of using version tags that may not be available immediately,
use the image digest output from the build step for reliable image
references in:
- SBOM generation
- Trivy security scanning (all 3 steps)

This fixes the error:
'could not parse reference: docker.io/gdxbsv/traktor:'

Also adds debug output to help troubleshoot image references.