ci: suppress known unfixable govulncheck findings in docker/docker

GO-2026-4887 and GO-2026-4883 are vulnerabilities in docker/docker
v28.5.2+incompatible (a testcontainers transitive dep used only in
integration tests). Both have Fixed in: N/A — no upstream patch is
available. Suppress these two IDs and fail only on actionable findings.

Remove the exclusions once docker/docker cuts a patched release.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: michaelmcnees

.github/workflows/engine-ci.yml

@@ -60,7 +60,16 @@ jobs:
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - name: Run govulncheck
-        run: govulncheck ./...
+        run: |
+          # GO-2026-4887 and GO-2026-4883 are in docker/docker (testcontainers test dep only).
+          # Fixed in: N/A — no upstream fix available. Remove exclusions when a patched release ships.
+          OUTPUT=$(govulncheck ./... 2>&1 || true)
+          echo "$OUTPUT"
+          ACTIONABLE=$(echo "$OUTPUT" | grep -E '^Vulnerability #[0-9]+:' | grep -vE 'GO-2026-4887|GO-2026-4883')
+          if [ -n "$ACTIONABLE" ]; then
+            echo "FAIL: unfixed actionable vulnerabilities found"
+            exit 1
+          fi
 
   gosec:
     name: Gosec