Add secret scanning, Dockerfile lint, ruff lint/format gate, coverage gate, and automatic CVE remediation PRs

- gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR
- new ruff lint stage (ruff.toml pins known-first-party for host/container
  consistency; F841/B007 in webui.py left un-fixed via per-file-ignores —
  app-logic changes, flagged for review rather than auto-fixed)
- pytest --cov-fail-under=90 gate on the test stage (already had pytest-cov,
  never wired into CI until now)
- scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR
  if it clears the finding, instead of just failing red
- ruff --fix/--format applied to existing code to start the gate clean

tests/test_image_processor.py

@@ -1,5 +1,3 @@
-from pathlib import Path
-
 from PIL import Image
 
 from src.py.builder import image_processor as ip
@@ -101,8 +99,13 @@ def test_generate_favicons_from_logo_creates_all_sizes(tmp_path, make_image):
     ip.generate_favicons_from_logo({"favicon": {"path": "favicon.png"}}, theme_dir, output_dir)
 
     expected = [
-        "favicon-32.png", "favicon-96.png", "favicon-128.png",
-        "favicon-192.png", "favicon-196.png", "favicon-152.png", "favicon-180.png",
+        "favicon-32.png",
+        "favicon-96.png",
+        "favicon-128.png",
+        "favicon-192.png",
+        "favicon-196.png",
+        "favicon-152.png",
+        "favicon-180.png",
     ]
     for name in expected:
         assert (output_dir / name).exists()