[vharseko]

The Docker build job fails before vulnerability scanning because the Trivy installer downloads through get.trivy.dev, which fails DNS resolution with curl exit code 6. The image build, UI smoke tests, and multi-server test succeeded in the affected run.

Add a shared Linux x64 setup action that downloads Trivy 0.70.0 directly from GitHub Releases, verifies a pinned SHA-256 digest before extraction, and retries failed downloads. Both Build and Docker Scan use this action and skip the upstream installer. Extend the build job's sparse checkout to include the local action.

Validation:

• Downloaded, verified, installed, and ran the real Trivy 0.70.0 binary in a Linux container, including discovery through the exported PATH.
• Confirmed that a corrupt archive, a failed download, and an unsupported architecture fail before installation or PATH publication.
• Workflow validation, ShellCheck for the new script, and git diff --check pass. The full workflow lint reports only the same nine pre-existing ShellCheck findings as origin/master.
• Independent code review found no issues. The complete GitHub Actions workflows have not been run for this change yet.