fix(ci): align Trivy change detection and scan baselines

[alangou]

Summary

A documentation-only PR could fail Trivy because its tested merge commit was compared with an older base SHA from the event. Resolve the baseline from the tested merge commit's first parent and use that same pair for change detection and scanning, including reruns.

Related Issue

No issue required: localized CI comparison bug. Observed on the documentation-only PR #2048 (failed Trivy run).

Changes

• Check out the exact PR merge SHA with both parents and reject a non-merge checkout.
• Pass explicit base/head SHAs to the existing changed-files action and use the resolved base for Trivy. Count moved files as additions and deletions so moving a file out of a watched directory still triggers scanning.
• Keep merge-group and manual-run behavior unchanged; update CI documentation and troubleshooting guidance.

Testing

• mise run pre-commit passes on the pushed commit.
• mise run ci passes on the pushed commit (lint, compile/type checks, and tests).
• Executed the pinned changed-files action against shallow synthetic Git histories: documentation-only changes with an older event baseline skip scanning; Helm modifications, deletions, and moves trigger scanning; invalid non-merge checkouts fail.
• Real Trivy scans of the chart: adding harmless metadata to the affected ClusterRole passes while its five existing alerts remain; adding wildcard permissions fails.
• Actionlint, ShellCheck, Zizmor, and Markdown validation pass.
• No application or sandbox runtime changes; no E2E changes required.

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Architecture documentation updated