fix(ci): use --input flag for trivy OCI archive scan

The 'oci-archive:' prefix is not a valid image reference for
'trivy image'. Use --input flag to specify the local archive path.

https://claude.ai/code/session_01UQCFLkpP9z23jGo7zgAjvB

Author: claude

.github/workflows/release.yaml

@@ -116,7 +116,7 @@ jobs:
           trivy image \
             --severity HIGH,CRITICAL \
             --exit-code 1 \
-            "oci-archive:build/${IMAGE_NAME}.tar"
+            --input "build/${IMAGE_NAME}.tar"
 
       - name: Login to GHCR
         env: