[pod-reloader] Scan only the real release line and scan every release tag

[Glitchy-Sheep]

Description

.github/workflows/trivy_image_check.yaml:

• Regular scan: latest_releases_amount default 3 -> 1. A comment says when to raise it.
• Release scan: the workflow also runs after "Build and push for prod" succeeds. It scans the tag that was just built and nothing else.
• Job name stays static. GitHub shows an expression in a job name unevaluated when the job is skipped.

PR scans, schedule, secrets and the action version stay as in #30.

Why do we need it, and what problem does it solve?

Regular scan is red on every run

• The script scans the latest patch of the N newest major.minor lines found in the prod registry.
• pod-reloader has one line, 1.0. All five release channels point to v1.0.14.
• The registry also has tags v0.1.0 and v0.2.0. Both point to one image from July 2025 with 59 open CVEs.
• That image was never a release: no git tag, no channel.
• With N=3 the script scans it and exits 1. main and v1.0.14 are clean (runs 35092061032, 35209203758).
• With N=1 the scan covers what customers can run. The regulation leaves N to the module team (sections 2.6 and 6.1; three is required only for DKP itself).
• Rule from the comment: raise N when a new minor ships while the old one is still on a channel.

New release tags are not scanned

• Regulation section 6.1 asks for a scan when a release tag is created.
• Until now a new tag waited for the next scheduled run, up to three days.
• A push: tags trigger would race the prod build, which takes about 15 minutes. So the scan waits for that workflow to finish instead.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

CI-only change. Verified on the branch: PR scan and a manual regular scan are green, Tags to check in registry: main v1.0.14 (see the comment below). The release scan cannot run before merge: workflow_run fires from the default branch only. First real run is the next release tag.

[Glitchy-Sheep]

Verified on this branch:

• PR scan (pr32): https://github.com/deckhouse/pod-reloader/actions/runs/35226789891 - green.
• Regular scan via workflow_dispatch: https://github.com/deckhouse/pod-reloader/actions/runs/35226831896 - green. Log: Effective flags: ... CS_LATEST_RELEASES_AMOUNT=1, Tags to check in registry: main v1.0.14, both tags Vulnerabilities not found, exit 0.

For comparison, the last regular scan on main with N=3 (https://github.com/deckhouse/pod-reloader/actions/runs/35209203758) scanned main v0.1.0 v0.2.0 v1.0.14 and failed on the v0.x image.