fix(ci): make grype scan non-fatal, add diagnostic enforcement step

The scan-action fail-build: true was preventing grype.json from being written
when vulnerabilities were found, making it impossible to diagnose which CVEs
were triggering the gate. Changed to fail-build: false + separate enforcement
step that prints CVE details and exits 1, so the JSON artifact survives.

Author: Coding-Dev-Tools

.github/workflows/release.yml

@@ -595,11 +595,30 @@ jobs:
         uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
         with:
           image: engraphis:release
-          fail-build: true
+          fail-build: false
           severity-cutoff: high
           only-fixed: true
           output-format: json
           output-file: container-evidence/grype.json
+      - name: Enforce grype severity gate
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -c "
+          import json, sys
+          data = json.load(open('container-evidence/grype.json'))
+          matches = [m for m in data.get('matches', [])
+                     if m.get('vulnerability', {}).get('severity', '') in ('High', 'Critical')]
+          for m in matches:
+              v = m['vulnerability']
+              a = m.get('artifact', {})
+              fix = v.get('fix', {})
+              print(f\"{v['id']}  {v['severity']}  {a.get('name','?')}  {a.get('version','?')}  fix={fix.get('versions','none')}  ns={v.get('namespace','?')}\")
+          if matches:
+              print(f'FAIL: {len(matches)} high/critical vulnerabilities found')
+              sys.exit(1)
+          print('PASS: no high/critical vulnerabilities')
+          "
       - name: Verify production image OCR runtime
         run: >-
           docker run --rm --entrypoint sh engraphis:release -c