Code Polishy 0.33.0

• Update the Trivy scanner and its security assessments independently of Code
  Polishy through publisher-signed scanner packages. scanner-update previews
  an exact HTTPS package and --apply records its complete signed manifest in
  the repository lock. Scanner images, assessments, evidence and reassessment
  deadlines are authenticated by the publisher key carried in the release.
• Preserve compatible scanner selections across Code Polishy upgrades. Reject
  incompatible publishers or execution contracts, and prevent a scanner update
  from overwriting a concurrent release or scanner selection. Expired
  assessments block security acceptance while update and recovery remain
  available.
• Publish scanner packages through the protected scanner publication workflow,
  with installed scanner checks on Linux amd64 and arm64 before publication.
  Reports and reusable gate evidence identify the selected scanner manifest.
• Assess CVE-2026-78661 for the exact Trivy 0.76.1 scanner images after inspecting
  both Linux architectures. The affected HTML parser is absent from both
  executables; the authenticated assessment retains the finding visibly.
• Migration: after upgrading to this release, explicitly preview and apply a
  published scanner package with scanner-update --manifest URL --sha256 DIGEST
  and then the same command with --apply. Artifact-security checks require
  this selection; the bundled bootstrap fixture is not a default selection.

Native archives for Code Polishy 0.33.0.

Source revision: 2c90297
Publication index SHA-256: 01e174a4894e54f83e617e2554e1016a40111f2606cfd86e9782f38b71f54deb
OCI image: ghcr.io/riteofstring/code-polishy:v0.33.0@sha256:3bbf7dafd91bf06a0f79b311cc753dd1aa441a550e8484317d1df941db2f635e