ci: run trivy directly; document CI/CD setup in RUNBOOK

trivy-action@v0.29.0 internally uses setup-trivy@v0.2.2, a tag removed
upstream (earliest published is now v0.2.6), so it cannot resolve on any
runner. Run trivy from a digest-pinned image instead, as gitleaks already is.

RUNBOOK gains a 'Setting up CI/CD from scratch' section with the traps that
actually cost time: GITEA_TOKEN is 401 at the package registry, the runner's
cache fails soft, service containers resolve by name not localhost.

Not pushed: pushing triggers a run, and the runner is being restarted by the
ansible change that enables its cache.

.gitea/workflows/ci.yaml

@@ -237,16 +237,35 @@ jobs:
             .
 
       - name: trivy
-        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
-        with:
-          image-ref: svcforge/${{ matrix.svc }}:ci
-          severity: HIGH,CRITICAL
-          # A CVE with no fix available is not something this PR can act on; failing on it
-          # only teaches people to add ignore entries. Rebuilding on a new base image picks
-          # the fix up the day it exists.
-          ignore-unfixed: true
-          exit-code: "1"
-          format: table
+        # Run trivy directly rather than via aquasecurity/trivy-action, for the same reason
+        # gitleaks is run directly above: the command is the documented one, pinned by
+        # digest, with no nested action resolution.
+        #
+        # It is also the only thing that works here. trivy-action internally does
+        # `uses: aquasecurity/setup-trivy@v0.2.2`, and that tag no longer exists upstream —
+        # the earliest published tag today is v0.2.6. The runner clones it and fails with
+        # "Unable to resolve v0.2.2: reference not found". A third-party action pinned by
+        # SHA still resolves ITS OWN dependencies by mutable tag, so pinning the outer
+        # action bought nothing.
+        #
+        # --ignore-unfixed: a CVE with no fix available is not something this PR can act
+        # on, and failing on it only teaches people to add ignore entries. Rebuilding on a
+        # new base image picks the fix up the day it exists.
+        #
+        # The mounted cache dir keeps the vuln DB (~50MB) across the three matrix legs on
+        # this runner instead of re-downloading it for each.
+        run: |
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PWD/.trivycache:/root/.cache/trivy" \
+            aquasec/trivy:0.58.1@sha256:ab70a02200597efa04748f210f793936eb647cbcdb0ea69cc30b226d6f5a22c7 \
+            image \
+              --severity HIGH,CRITICAL \
+              --ignore-unfixed \
+              --exit-code 1 \
+              --format table \
+              --no-progress \
+              svcforge/${{ matrix.svc }}:ci
 
       - name: push by digest
         if: github.ref == 'refs/heads/master' && github.event_name == 'push'