Run trivy in CI so the trivyignore boundary guards check what each entry hides #5864

What happens

The six scripts/tests/test-trivyignore-*-boundary.sh guards each have a behaviour layer that runs trivy. It checks that each .trivyignore.yaml entry still suppresses exactly the reviewed findings. The layer runs only where trivy is installed and otherwise prints SKIP(behavioural) and exits 0.

The validate job in .github/workflows/ci.yaml installs no trivy, so in CI only the structure and premise layers run. MegaLinter's trivy scan in the organization workflow reports findings, but it does not check what an ignore entry hides.

Example, found in the local review of #5853: add widget.key: <32 hex characters> to k8s/bases/apps/homepage/config-map.yaml.

• Without trivy, as in CI: the configmap-content guard passes with SKIP(behavioural).
• With trivy 0.76.1: the same guard fails. The reviewed matched set is Email; the actual set is Email,key.

Done when

• CI installs a pinned, checksum-verified trivy before the boundary guards run, the same way .github/scripts/setup-supply-chain-tools.sh installs Cosign and Syft, and keeps it in step with the trivy version CI's scan runs.
• In CI, each guard fails rather than skips when trivy is missing.
• The comments in .trivyignore.yaml and ci.yaml that say the matched sets are pinned are true in CI.

🤖 Generated with Claude Code