ci: integration artifact retention + toolchain bump-bot commit prefix

.github/workflows/integration-tests.yml

@@ -50,7 +50,7 @@ jobs:
         with:
           name: charon-integration-image
           path: /tmp/charon-image.tar
-          retention-days: 1 # Only needed for the duration of this run's fan-out jobs.
+          retention-days: 3 # Outlives the run so "Re-run failed jobs" still works >24h later (suite jobs no longer self-contain the build).
           if-no-files-found: error
 
   cerberus:

.github/workflows/toolchain-image.yml

@@ -426,14 +426,14 @@ jobs:
           base: development
           branch: bot/bump-toolchain-image
           delete-branch: true
-          title: "feat(security): refresh bundled proxy toolchain image"
+          title: "chore(docker): refresh bundled proxy toolchain image"
           labels: |
             dependencies
             automated
             docker
             security
           commit-message: |
-            feat(security): refresh bundled proxy toolchain image
+            chore(docker): refresh bundled proxy toolchain image
 
             Rebuilds the prebuilt Caddy/CrowdSec toolchain image so the shipped
             binaries pick up upstream fixes, and bumps the digest pin in the

docs/plans/current_spec.md

@@ -158,7 +158,7 @@ The composite action's own doc comment (`action.yml:16-33`) instructs CVE-scan c
 ### 2.5 Constraints from `CLAUDE.md` / `ARCHITECTURE.md`
 
 - All frontend in `frontend/`, backend in `backend/` — unaffected (this is CI/build only).
-- Conventional commits; `(security)` scope only for genuine security work, subject line vague. The digest-bump and freshness-guard commits *are* security-relevant — use `feat(security):` / `fix(security):` with vague subjects (e.g. `feat(security): pin bundled proxy toolchain to a scanned prebuilt image`).
+- Conventional commits; `(security)` scope only for genuine security work, subject line vague. The initial-pin and freshness-guard commits *are* security-relevant — use `feat(security):` / `fix(security):` with vague subjects (e.g. `feat(security): pin bundled proxy toolchain to a scanned prebuilt image`). The routine daily digest-refresh bot PR uses **`chore(docker):`** — `feat:` there makes release-please cut a minor release on every refresh.
 - Weekly `nightly → main` promotion PRs merge via **merge commit**. This feature's PR targets `development` (normal flow) — **confirmed it does not touch `weekly-nightly-promotion.yml`** and imposes no new constraint on the promotion merge method. (`weekly-nightly-promotion.yml` carries the app image through unchanged; the toolchain digest pin travels with the Dockerfile like any other line.)
 - `ARCHITECTURE.md` §"Deployment Architecture / Multi-Stage Dockerfile" (`:1082`), §"Infrastructure" table (`:158`), §"Directory Structure" (`:286`), §"Layer 2: CrowdSec Integration" (`:780`) must be updated (§9).
 - **Ignore-file check (CLAUDE.md "Ignore Files"):** the new files are `scripts/toolchain-key.sh`, `scripts/verify-toolchain-pin.sh`, `scripts/lib/dockerfile-stage.sh`, `scripts/tests/toolchain-key.bats` (+ `verify-toolchain-pin.bats`, `helpers/toolchain_fixture.bash`), `.github/workflows/toolchain-image.yml`, `docs/ci/toolchain-image.md`. **Correction (Rev 2.1):** the earlier claim that `scripts/` is not copied into the image was wrong — `Dockerfile` `COPY scripts/ /app/scripts/` copies the whole directory into the runtime image (it already ships ~40 `scripts/*.sh` + a pre-existing `.bats`). These four build-only helpers are used only by `toolchain-image.yml` and the `quality-checks.yml` `verify-toolchain-pin` / bats jobs from a plain checkout — never from inside a built container — so **`.dockerignore` now excludes `scripts/tests/`, `scripts/toolchain-key.sh`, `scripts/verify-toolchain-pin.sh`, `scripts/lib/dockerfile-stage.sh`** (blacklist semantics, no `!scripts/…` re-includes to fight). `.github/` and `docs/` are already excluded, so `toolchain-image.yml` / `docs/ci/toolchain-image.md` never enter the context. `.gitignore` — these are source files that must be committed; none matches an existing ignore glob → **no `.gitignore` change**. `.codecov.yml` — shell/bats and YAML carry no Go/TS coverage → **no `.codecov.yml` change**. Recorded explicitly per CLAUDE.md.
@@ -571,7 +571,7 @@ open-bump-pr:                # event == schedule | workflow_dispatch | workflow_
   - peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       base: development
       branch: bot/bump-toolchain-image           # updated in place if already open
-      title: "feat(security): refresh bundled proxy toolchain image"
+      title: "chore(docker): refresh bundled proxy toolchain image"
       labels: dependencies, automated, docker, security
       body: old→new digest, Trivy CRITICAL/HIGH summary, verification checklist
   - on failure: actions/github-script → open issue "🚨 Toolchain image rebuild failed"