Chunk CI-A of 2026-05-16-ci-pipeline-remediation.

Scorecard workflow was using ossf/scorecard-action@v2, a floating major
tag that the action does NOT publish. Every run failed at "Set up job"
with: "Unable to resolve action 'ossf/scorecard-action@v2', unable to
find version 'v2'".

Pinned to commit SHA 4eaacf0543bb3f2c246792bd56e8cdeffafb205a (= v2.4.3,
latest stable per GitHub releases API on 2026-05-16). SHA pin also
satisfies the OpenSSF Scorecard "pinned-dependencies" check.

Evidence: GitHub Actions run 25965785316 / job 76328940486.
Verification: YAML parses; SHA → commit verified via GitHub API.

Out-of-scope follow-ups (left untouched per chunk scope):
- actions/checkout@v4 (line 24) is still floating-major.
- github/codeql-action/upload-sarif@v3 (line 37) is still floating-major.

Chunk CI-B of 2026-05-16-ci-pipeline-remediation.

actions/setup-go and golangci/golangci-lint-action@v6 were both
extracting the Go toolchain cache, causing dozens of:
  /usr/bin/tar: ...golang.org/toolchain.../...: Cannot open: File exists

setup-go now passes `cache: false` in the Lint Go job; golangci-lint-action
manages its own cache. The test-go-unit job is left unchanged (no
collision there — it does not invoke golangci-lint-action).

Evidence: GitHub Actions run 25965858777 / job 76329132482.
Verification: surgical edit (one line added under Lint Go's setup-go
step); YAML parses.

Chunks CI-C1 and CI-D of 2026-05-16-ci-pipeline-remediation.

CI-C1 — build context
  Six service Dockerfiles COPY siblings (mintkey-models/, go.work,
  internal/, peer go.mod files); their builds need repo-root context.
  The matrix now carries a `dockerfile:` field per service, and the
  build step uses `--file "${{ matrix.dockerfile }}"` with the matching
  `context:` (`.` for sibling-COPY services, subdirectory for the
  self-contained ones).

  Sibling-COPY (context: .):  admin-api, mcp-server, broker,
                              vault-adapter, proxy-plugin, kong-syncer
  Self-contained:             admin-ui, seed-job, mock-backend,
                              jaeger-auth

  Evidence: GitHub Actions run 25965858776 / jobs 76329132598
  (admin-api), 76329132601 (mcp-server), 76329132602 (vault-adapter),
  76329132594 (proxy-plugin).
  Verification: local `docker build -f admin-api/Dockerfile -t test .`
  from repo root succeeds; vault-adapter ditto.

CI-D — Trivy CVE allow-list
  HIGH/CRITICAL CVEs in seed-job (Debian 13 base) and jaeger-auth
  (Alpine 3.19 + oauth2-proxy v7.6.0) tripped the Trivy gate.

  Approach: per-CVE allow-list in `.trivyignore`, each entry
  documenting (a) package, (b) Mintkey-specific mitigation/justification,
  (c) 2026-08-16 expiry (3 months). NO blanket severity downgrade;
  NO exit-code relaxation; SARIF still uploaded to the Security tab.

  33 unique CVE IDs total: 3 seed-job + 30 jaeger-auth (1 Alpine OS,
  5 oauth2-proxy app, 24 bundled Go stdlib/third-party). The
  oauth2-proxy bypass cluster is mitigated by Kong header stripping +
  internal-only exposure; upgrade tracked separately (MINTKEY-412).

  Workflow tweak: `trivyignores: .trivyignore` added to trivy-action's
  `with:` block (trivy-action@master could otherwise drift on
  auto-detection).

  Evidence: GitHub Actions run 25965858776 / jobs 76329132592
  (seed-job), 76329132597 (jaeger-auth).
  Verification: local `trivy image --severity HIGH,CRITICAL --ignorefile
  .trivyignore --exit-code 1 mintkey-{seed-job,jaeger-auth}:scan`
  exits 0 for both.

Also: gitignore `**/.pnpm-store/` (local pnpm content-addressable
cache created by `pnpm install`; never to be committed).

PASS_ALL per fresh REVIEWER. 3 atomic chunks committed; CI-C2 verified
needing no changes (pnpm v11 overrides validation differs from v9).
33 CVEs documented in .trivyignore with 2026-08-16 expiry.