fix(security-scan): unblock agent step + harden trivy image scans

Pipeline 850 reproduced two distinct failures:

1. image-scans died — Apache Tika hit Trivy's default 5-minute
   `context deadline exceeded`, and goauthentik/server's 30MB
   msgraph kiota-dom-export.txt blew the secret scanner's memory
   budget (Trivy itself warned about it).

2. security-fix-agent was skipped despite `failure: ignore` on
   image-scans. Woodpecker's `failure: ignore` only affects
   *workflow* status — downstream steps still gate on the
   previous step's exit, defaulting to status: [success].

Fixes:

- `--timeout 15m` and `--scanners vuln` on per-image trivy calls.
  We only care about CVEs (CRITICAL/HIGH, with FixedVersion) — the
  secret scanner was the OOM culprit and adds no value for our
  agent's decision rules.
- `when: status: [success, failure]` on security-fix-agent so it
  always runs, regardless of which scans crashed. The step's own
  gating logic already handles missing/empty JSON files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.woodpecker/security-scan.yml

@@ -32,7 +32,7 @@ steps:
           i=$$((i+1))
           out="trivy-image-$$i.json"
           echo "=== [$$i] $$img -> $$out ==="
-          trivy image --skip-db-update --severity CRITICAL,HIGH --ignore-unfixed --format json -o "$$out" "$$img" || true
+          trivy image --skip-db-update --scanners vuln --timeout 15m --severity CRITICAL,HIGH --ignore-unfixed --format json -o "$$out" "$$img" || true
         done < /tmp/images.txt
     failure: ignore
 
@@ -40,8 +40,16 @@ steps:
     # Auto-fix run: only on master (cron / manual / direct push). On the
     # bot's own PR branches, the scans re-run as a re-validation gate but
     # this step is skipped — otherwise we'd fork-bomb PRs.
+    #
+    # status: [success, failure] is required: image-scans has
+    # `failure: ignore` to avoid failing the workflow on a single
+    # bad image, but Woodpecker still skips downstream steps after
+    # a failed step unless they explicitly opt in. The agent's gating
+    # logic handles missing/empty JSON files gracefully — better to
+    # always reach the gate than silently skip on a flaky scan.
     when:
       - branch: master
+        status: [success, failure]
     image: gitea.renner.uno/gitea_admin/ci-claude:2026-05-01
     environment:
       CLAUDE_CODE_OAUTH_TOKEN: