ci(osv): exclude intentionally vulnerable fixtures from scheduled scan

[Copilot]

scan-scheduled / osv-scan was failing because the scheduled/push OSV run recursively scanned fixtures/, which intentionally contains vulnerable dependency manifests for regression scenarios. This caused the scanner path to fail the job instead of reflecting runtime-code risk.

• Root cause in workflow behavior

  • scan-scheduled used recursive source scanning over ./, which included fixtures/** and surfaced expected test-fixture vulnerabilities as CI failures.

• Workflow adjustment

  • Updated .github/workflows/osv-scanner.yml (scan-scheduled job) to exclude fixture directories from OSV source traversal.
  • Kept existing scan scope (-r ./) and fail-on-vuln policy unchanged for non-fixture content.

• Effective diff

  scan-args: |-
    --experimental-exclude=fixtures
    -r
    ./