fix(ci): keep trivy cache out of docker image

.dockerignore

@@ -43,6 +43,7 @@ venv.bak/
 .agent-work/
 .runtime/
 .tmp/
+.cache/
 node_modules/
 public/
 .moviepilot.env

.github/workflows/build-v3.yml

@@ -161,6 +161,7 @@ jobs:
         with:
           image-ref: moviepilot-v3-candidate:linux-amd64
           version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
           scanners: vuln
           vuln-type: os,library
           severity: HIGH,CRITICAL
@@ -191,6 +192,7 @@ jobs:
         with:
           image-ref: moviepilot-v3-candidate:linux-arm64
           version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
           scanners: vuln
           vuln-type: os,library
           severity: HIGH,CRITICAL

tests/test_docker_payload_contract.py

@@ -25,6 +25,7 @@ def test_build_context_excludes_runtime_state_and_keeps_release_inputs() -> None
         ".agent-work/",
         ".runtime/",
         ".tmp/",
+        ".cache/",
         "node_modules/",
         "public/",
         ".moviepilot.env",

tests/test_release_supply_chain.py

@@ -76,6 +76,7 @@ def test_release_scans_both_architectures_before_registry_login_and_publish() ->
         "Scan arm64 candidate vulnerabilities",
     ):
         scan = indexed[name]
+        assert scan["with"]["cache-dir"] == "${{ runner.temp }}/trivy"
         assert scan["uses"] == (
             "aquasecurity/trivy-action@"
             "a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8"