d1ab842283
Un-neuter grype CVE gate (was || echo, now fails on critical). Add .grype.yaml with ignore for CVE-2026-41589 (wish SCP — unreachable, we only import wish/bubbletea). Pin: grype v0.114.0, git-cliff v2.13.1, govulncheck v1.1.4. Tag `latest` only on tag push, not workflow_dispatch. Build path ./cmd/uptop (survives a main.go split). Add dist/ and uptop to .dockerignore.