fix: trivy cache isolation + 0.70.0 bump + multi-image report heading

[Cre-eD]

Three small fixes surfaced from the first PAY-SPACE prod rollout:

1. Trivy cache lock timeout

Symptom (pay_space_wallet, crypto-tools runs):

ERROR Failed to acquire cache or database lock, see https://trivy.dev/docs/...
FATAL image scan error: unable to initialize fs cache: cache may be in use by another process: timeout

Cause: Trivy uses file locks on its cache directory to synchronize DB access. When the cache persists across runs (Blacksmith persistent cache) or a prior trivy crashed, stale locks cause the next scan to time out waiting for them.

Fix: Use a per-scan ephemeral cache directory via os.MkdirTemp("<userCache>/trivy", "scan-*"), with defer cleanup in Scan(). Eliminates lock contention entirely. Cost: re-downloads the ~100MB vulnerability DB per scan (a few seconds), acceptable for CI. Codex flagged the earlier "just delete the lock files" approach as unsafe under real concurrency — this version sidesteps the race entirely.

Updated TestEnsureTrivyCacheDir to assert the per-invocation scan-* suffix and that two calls return different directories.

2. Trivy version bump 0.69.3 → 0.70.0

Scan logs from the 0.69.3 runs surface the upstream notice:

📣 Notices:
  - Version 0.70.0 of Trivy is now available, current version is 0.69.3

3. Multi-image report heading disambiguation

Symptom (PAY-SPACE/pay_space_wallet): the step summary showed what looked like the same Security Pipeline Summary report twice.

Cause: The pay_space_wallet stack builds two images (web + worker), so the pipeline creates one security-report-<image> local.Command per image. Each one writes ## Security Pipeline Summary to $GITHUB_STEP_SUMMARY. Both reports have identical scan counts (same codebase, different entrypoints), so two distinct reports look like a duplicate.

Fix: Suffix the heading with the image name:

## Security Pipeline Summary — web
**Image:** `...--web@sha256:...`

## Security Pipeline Summary — worker
**Image:** `...--worker@sha256:...`

Verification

• go build ./... clean
• go test ./pkg/security/scan/... green (incl. updated cache-dir tests)
• go test ./pkg/clouds/pulumi/docker/... green