fix(ci): harden core tool watch issue reconciliation

[lelia]

What changed

• Run full watch/reconciliation mode on relevant main pushes, while keeping pull requests in build-guard mode.
• Reconcile one canonical core-tool-drift issue: update/reopen it when drift exists, refresh and close it when drift is resolved, and avoid resolving it when release discovery is incomplete.
• Discover Trivy releases from the repo-authorized private ghcr.io/socketdev/trivy package produced by SocketDev/trivy-dist, with packages: read, instead of Aqua's release feed.
• Rename the existing Socket row to Socket SDK (socket-sdk-python) and add rows for Socket Python CLI (socket-python-cli) and Socket npm CLI (socket-cli).
• Pin the npm socket CLI in every image and pin socketsecurity in app_tests; also watch Dockerfile.heavy.
• Remove the publish-docker workflow's create-release job. Image publishing now ends after manifest verification, leaving GitHub release authoring intentionally manual.

Root cause

The post-release run was triggered by a push, which selected mode=build. That mode intentionally skipped latest-version discovery, and the issue step only ran for watch-mode reports with active drift. The job therefore generated and uploaded a fresh report but never reconciled issue #93, leaving its pre-merge pins in place.

Impact

After this lands, a relevant merge to main immediately refreshes issue #93. If every tracked tool is current, the workflow updates the body and closes the issue; later drift reuses and reopens the same issue rather than creating duplicates. Transient feed failures are called out in the report and cannot falsely resolve drift.

The Docker publish workflow no longer starts a runner for an automatic GitHub release step that is expected to no-op. Maintainers remain responsible for authoring each release and may still use GitHub's generated notes manually.

Validation

• uv run --no-sync pytest -q — 222 passed
• actionlint .github/workflows/core-tool-watch.yml
• actionlint .github/workflows/publish-docker.yml
• zizmor .github/workflows/publish-docker.yml — no findings
• git diff --check
• Local build-mode report exercised all six pinned tool coordinates and emitted discovery_complete=true