P2 audit remediation: supply chain + deployment hardening - #25

Implements the P2 tier of docs/reviews/full-audit-2026-07-05.md §10 (supply chain / deployment hardening).

Stacked on #24 (P1). Base is the P1 branch so this PR's diff shows only P2. Retarget down the stack as earlier tiers merge.

Fully fixed + tested

• SCN-3 (Medium). cors_origins and filesystem_scan_roots now parse their documented comma-separated env form. pydantic-settings tries json.loads on a list[str] env value, so SCRYE_FILESYSTEM_SCAN_ROOTS=/srv/scan — the enable switch for the security-gated filesystem-scan feature — failed at startup. Fixed with NoDecode + a field_validator(mode="before"). New tests construct Settings straight from the env var.
• INF-5 (Medium, PLAUSIBLE). Added a small RAM-backed tmpfs:[/run] to the docker-socket-proxy sidecar (HAProxy needs a writable /run under read_only), with a note to live-verify the profile and only add cap_add:[SETUID,SETGID] if it still can't drop privileges.

Applied as documentation / conservative change (see notes)

• INF-1 (Medium). Added .github/dependabot.yml (github-actions ecosystem, weekly, grouped). The other half of INF-1 — pinning each uses: to a commit SHA — could not be completed here: this environment's egress policy blocks GitHub outside this repo, so current action SHAs can't be resolved/verified, and pinning to an unverified SHA would risk red CI. Flagged for a follow-up where SHAs can be resolved (Dependabot will then keep them current).
• INF-3 (Low). Aligned CLAUDE.md §6's :dev wording with the implemented merged-PR-into-dev trigger (it still said "every push to dev"). Documentation only — no behavior change.
• INF-4 (Medium). Documented the trivy-server root exception in the compose file (the upstream aquasec/trivy image ships no non-root USER and hard-codes /root/.cache, so a non-root user: would break the DB cache on a root-owned named volume). Per the audit's accepted alternative, with the mitigations spelled out (profile-gated, internal-net-only, read-only FS, no-new-privileges, cap_drop ALL, resource-limited).

Needs your decision — INF-2

The :dev publish silently fails for a fork PR merged into dev (fork PRs get no repo secrets → the Docker Hub login fails). The audit's fix is to switch the trigger to on: push: branches:[dev] (base-repo context has secrets). That reverses the deliberate merged-PR trigger you set in the 2026-07-04 deviation (chosen to avoid double-publishing on conflict-resolution pushes) and is a distribution locked-decision (§6) change — so I did not make it unilaterally. I documented the limitation as accepted in publish.yml instead. Tell me if you'd like me to switch to the push-based trigger (I'll revert the INF-3 wording accordingly).

Testing

• tests/test_config.py: comma-separated env parsing (single + multi + python-list passthrough) for both list settings.
• Config + compose-hardening + targets-API tests: 22 passed. ruff + black clean; .env.example in sync.

Deviation logged in docs/PLAN.md § Deviations (2026-07-05 P2 entry).