Add secret scanning, Dockerfile lint, ruff lint/format gate, coverage gate, and automatic CVE remediation PRs

- gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR
- new ruff lint stage (ruff.toml pins known-first-party for host/container
  consistency; B905 in env_config.py's zip() left un-fixed — app-logic change,
  see feedback-no-app-logic-changes)
- pytest --cov-fail-under=75 gate on the test stage
- scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR
  if it clears the finding, instead of just failing red
- ruff --fix/--format applied to existing code to start the gate clean

app/main.py

@@ -1,17 +1,20 @@
-import time
 import logging
 import signal
 import sys
-from gpu_checker import check_rtx_50_founders
+import time
+
 from env_config import REFRESH_TIME
+from gpu_checker import check_rtx_50_founders
+
 
 # Signal handler function
 def handle_exit(signum, frame):
     logging.info(f"🛑 Received signal {signum}. Exiting gracefully...")
     sys.exit(0)
 
+
 # Register signal handlers
-signal.signal(signal.SIGINT, handle_exit)   # Ctrl+C
+signal.signal(signal.SIGINT, handle_exit)  # Ctrl+C
 signal.signal(signal.SIGTERM, handle_exit)  # docker stop / kill -15
 
 if __name__ == "__main__":
@@ -24,4 +27,3 @@ if __name__ == "__main__":
     except KeyboardInterrupt:
         logging.info("🛑 Script interrupted by user (KeyboardInterrupt). Exiting gracefully.")
         sys.exit(0)
-