Limit container image scanning to gh-* workflow images

[Copilot]

The daily container image scan was sweeping every container referenced by compiled workflow manifests, including third-party MCP and example images. This change narrows the scan set to GitHub-owned gh-* images so the workflow reports on the containers we maintain.

• Scope reduction

  • Filter manifest-derived container entries before deduplication so only images with a path component matching gh-* are included in images.json.
  • This keeps the scan focused on gh-aw and related GitHub-managed containers such as gh-aw-firewall/*, gh-aw-node, and gh-aw-mcpg.

• Workflow behavior

  • Preserve the existing manifest extraction, pin validation, vulnerability scanning, and issue reporting flow.
  • Only the candidate image set changes; downstream scan logic remains unchanged.

• Generated artifacts

  • Recompiled daily-squid-image-scan.lock.yml to keep the generated workflow in sync with the source workflow.

[
  .[].containers[]?
  | select(.image | test("(^|/)gh-[^/:@]+"))
]
| unique_by(.pinned_image)
| sort_by(.image)