Restore official Buccaneerr tools with expiring CLI exceptions 🧭🌈

[scottgigawatt]

Buccaneerr returns to digest-pinned official Compose 5.6.0 and Alpine actionlint instead of maintaining project-specific Go builds. Current Docker CLI 29.9.0, smol-toml 1.9.1, Ruff 0.17.0, filelock 4.1.0, python-discovery 1.6.2, integrity hashes, and production security fixes are preserved from main. 🏴‍☠️🌈

The fixed HIGH/CRITICAL gate retains expiring exceptions for CVE-2026-78667 and CVE-2026-97031 at exact Compose/actionlint paths. The fresh scan additionally reports CVE-2026-78669 in official Compose; that exception applies only to its exact binary path. All expire on October 23, 2026. Documentation explains the server-path boundaries for the first two and the HTTP/2 client-and-server risk for the third: supported checks use trusted fixtures and the test wrapper's local Unix Docker socket, but unsupported use against untrusted HTTP/2 peers retains risk. Docker CLI, unrelated binaries, braces, and the OpenPGP warning remain outside these exceptions. Full artifact reviews remain unfiltered.

Current main 7c2cb44345094a63867fa1c2b926825194c4ace5, including merged quieter-policy PR #128, is an ancestor of refreshed head 8e8de8c4ea25532a720855535c3f6f9c52b1239a. The combined Renovate configuration matches the centrally validated fixture exactly. The merge conflict concerned the deleted custom Go stage; no newer dependency was downgraded.

Validation: the real Trivy scope/expiry fixture has 14 findings, filters only the six intended package instances, retains all eight negative controls, and retains all 14 when expired. Local YAML, secret, whitespace, pin-policy, executable-mode, Markdown, and CSpell checks pass (132 files, zero spelling issues). Container wrapper hooks cannot resolve this isolated worktree's external Git metadata; their direct tool equivalents pass, including strict Pyright with zero errors or warnings. Independent scope review passed. All five fresh GitHub checks pass at signed head 00dd4e2c523ce403d4263cef34aea0730562e395: complete repository validation, all three platform builds, both real image gates, developer docs, and CodeQL (validation run). Eight isolated wrapper cases also confirm remote Docker contexts are rejected before execution and injected DOCKER_HOST is not forwarded.

The user has authorized merging after fresh validation; auto-merge remains off. Both incoming commits, including the current-main refresh, are GitHub-verified signed commits. Earlier unsigned commits remain excluded and signature protection remains intact. Fresh checks are running for the refreshed SHA (validation run); no GitHub review was impersonated.