CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing (#34)

- release changelog: commits rendered as description (link), divider lines dropped
- gitleaks secret scan and hadolint on every push/PR
- ruff lint/format gate (Python repos) with a pytest --cov-fail-under gate
- scheduled CRITICAL Trivy failures attempt an apk upgrade rebuild and open a follow-up PR if it clears the finding, instead of just failing red
- images also published to ghcr.io/djeex/<repo>
- a matching GitHub Release is created on the GitHub mirror, with a notice pointing back to this repo as the source of truth

tests/test_image_processor.py

@@ -1,5 +1,3 @@
-from pathlib import Path
-
 from PIL import Image
 
 from src.py.builder import image_processor as ip
@@ -101,8 +99,13 @@ def test_generate_favicons_from_logo_creates_all_sizes(tmp_path, make_image):
     ip.generate_favicons_from_logo({"favicon": {"path": "favicon.png"}}, theme_dir, output_dir)
 
     expected = [
-        "favicon-32.png", "favicon-96.png", "favicon-128.png",
-        "favicon-192.png", "favicon-196.png", "favicon-152.png", "favicon-180.png",
+        "favicon-32.png",
+        "favicon-96.png",
+        "favicon-128.png",
+        "favicon-192.png",
+        "favicon-196.png",
+        "favicon-152.png",
+        "favicon-180.png",
     ]
     for name in expected:
         assert (output_dir / name).exists()