v1.7.0

Improvements

• Container-image scanning for the trivy and grype collectors (#221) — a new container-rescan sub-collector runs a scheduled scan of the most recently shipped image (resolved from a docker push / --push build in .containers.native.docker.cicd.cmds[]) inside the collector's baked-DB image (daemonless), normalizing results to .container_scan. The cicd sub-collector now also routes a user's own trivy image / grype <ref> runs to .container_scan (while fs/dir:/sbom: scans still feed .sca). Feeds the existing container-scan policy, whose max-severity check now lists the offending packages/CVEs (most-severe-first, capped at 10). Registry auth via the REGISTRY_USERNAME/REGISTRY_PASSWORD secrets. No collector-dependency feature required.
• backstage cataloger: configurable API path prefix (#236) — the Backstage API path prefix is now set via input instead of being hard-coded.
• trivy: scan sub-collectors declare size: large (#235) — right-sizes the scan workloads.

Fixes

• Policies PEND instead of FAIL during collection (#230) — nine collector-backed presence checks (7 ai/*, 2 git/*) rendered a spurious FAIL on live PRs while collection was still in flight, then flipped to pass/pending once collectors finished. They now gate presence with node.exists() (the pattern the vcs checks already use): a missing value PENDs during the interim and only FAILs once collection has genuinely finished, preserving universal-enforcement semantics.

Other

• docs(releasing) (#231) — the Step 7 cronos bump now targets the lunar-config.d/ split.