security: fix CVE-2026-26960 and harden Docker Scout gate #72

Job	Run time
quality-gate	47s
codeql	1m 34s
build-platform (linux/arm64, ubuntu-24.04-arm)	35s
build-platform (linux/amd64, ubuntu-latest)	30s
security-scan	0s
merge-and-push	0s
	3m 26s

Provide feedback