ci: retire the base-image scan categories; release pre-flight reflects built-image scanning

[JayVDZ]

Description

Follow-up to #1637.

1. Removes the retire-base-image-scan-categories migration job. It existed only to keep the three old trivy-base-image-* categories uploaded until they could be deleted from code scanning. All three (and the ten older line-keyed categories orphaned since the category rename) have now been deleted via the API, so the Trivy merge check has nothing left to compare against and the job goes. The Developer Guide's "Retiring a code scanning category" procedure now records how the deletion actually works: API-only, one set per category per git ref, driven to exhaustion with the script shown, and around 8,000 deletions against the 5,000-per-hour limit for this retirement.
2. Release pre-flight docs. engineering/RELEASE_PROCESS.md and the /release skill still asked for a manual apt-cache check of pinned packages against the base image (naming a package renamed in Noble). Both now point at the gates that replaced it: apt-get upgrade before the pinned installs fails the build on a stale pin, and the scan-images job builds and scans every production image on each push to main.

No public docs change: nothing under docs/ describes image scanning or pinning.

Closes #

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactor (no functional change)
• Other (describe below): CI migration step removed

Testing

• dotnet build JIM.sln succeeds with zero errors
• dotnet test JIM.sln passes
• New functionality has tests (unit, workflow, or integration as appropriate)
• Manually tested in a local development environment

No .NET code changes. The workflow was re-validated with the CodeQL actions queries locally (zero results); the Trivy configuration listing after deletion shows only the three trivy-image-* categories.

Documentation

• Public documentation updated (docs/); page(s):
• Engineering reference documentation updated (engineering/) where a design/architecture doc would otherwise be stale
• No documentation needed

Docs: n/a - CI and engineering-process change with no user-facing behaviour

Checklist

• My commit messages are descriptive and reference the relevant Issue (if any)
• My code follows the conventions in docs/DEVELOPER_GUIDE.md
• User-facing text uses British English (en-GB)
• This PR does not include security-sensitive information (real credentials, customer data, internal hostnames)

Additional context

The Trivy merge check on this PR is the proof the retirement is complete: with the old categories deleted and their uploads removed, it must report only the three trivy-image-* configurations present on main.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TbLEyxJhFzfRL6cexuGmgp

---

Generated by Claude Code