chore: sync main with latest OSSF and container hardening

[seonghobae]

Summary

• backport the latest develop-side OpenSSF, Docker, and fuzzing hardening into main
• bring the stable branch up to the same container packaging, ClusterFuzzLite, provenance export, and scorecard policy level as develop
• prepare main for the next tagged release after the OSSF and container work lands

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e68202f7-c31a-46f6-ab84-e3d195df2de8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[seonghobae]

Closing this sync PR for now because it is a dirty merge over earlier squash history. The immediate OpenSSF/Scorecard work was completed on develop; stable-branch synchronization can be revisited with a clean backport/release branch when the next release cut is prepared.