ci: add manual workflow to retag docker image by digest

ci: publish altinity and latest tags from main only

ci: limit SAST to non-test new issues

ci: pass relative package patterns to golangci-lint

ci: run golangci-lint on filtered package set

ci: stabilize security workflow and exclude unsupported providers

ci: unblock security scans by narrowing unsupported package scope

ci: fix duplicate test-report if in workflows

ci: reduce push fan-out and keep full matrix for PR/manual

fix: upgrade aws sdk and modernize docker/helm github actions