ci: fix the three red crosses (lint, trivy pin, Pages)

[tusharbeckham]

All 12 unit-test jobs were already green (py3.11–3.14 across ubuntu/macos/windows). Three jobs were failing for three unrelated reasons — plus a fourth that was hidden behind one of them.

1. SAST + lint — 7 unused imports

ruff reported 7 F401 unused imports in bus.py, hunt.py, store.py, worker.py, tests/test_store.py. Removed. 255 tests still pass, so nothing was being re-exported through them.

Root cause: the linters were installed unpinned, so a newer ruff widened F401 and broke CI with no code change. Now ruff==0.16.1 and bandit[toml]==1.9.4. Selecting rules in ruff.toml does not protect you when a release changes what an existing rule detects — which is exactly what happened.

2. SAST + lint — a second failure hiding behind the first

Bandit also exited 1, with 10 Medium findings. It never ran in CI because the lint step failed first, so fixing ruff alone would only have moved the cross one step to the right.

I reviewed all 10. Every one is a false positive or a deliberate control, so each gets a per-line # nosec <rule> - <reason> instead of lowering the -ll threshold:

Rule	Count	Why it's safe
B608	7	SQL concatenates static predicate fragments; every user value is bound through a ? placeholder. worker.py builds its IN list as a join of ?. Properly parameterised.
B608	1	Schema-migration insert — executescript takes no params; version is int()-cast, name is ''-escaped.
B104	2	config.py:181 is the guard that refuses to bind 0.0.0.0 in prod — bandit flagged the security control itself. space_server binds all interfaces by design for the container/Space console.
B310	1	urlopen against a hardcoded http://127.0.0.1 loopback upstream.

3. image build + filesystem scan — unresolvable action

Unable to resolve action aquasecurity/trivy-action@0.36.0, unable to find version 0.36.0

The action publishes v-prefixed tags, so bare 0.36.0 doesn't exist and the job died in Set up job before any step ran. Now v0.36.0.

This is the same mistake the previous fix made with 0.24.0, so the comment now records how to check:

gh api repos/aquasecurity/trivy-action/tags --jq '.[0:5][].name'

4. pages / build console — Pages site could not be created

Create Pages site failed. Error: Resource not accessible by integration

configure-pages@v5 with enablement: true cannot create a Pages site using GITHUB_TOKEN: pages: write permits deploying, not creating. The workflow's intent (no undocumented click) was right but isn't achievable with that token.

Fixed outside the code by enabling Pages once on the repo with build_type=workflow → https://tusharbeckham.github.io/SentinelAI/. No workflow change needed — enablement: true is now a harmless no-op that still helps anyone who clones this.

Verification (local)

ruff check --config ruff.toml sentinelai tests  -> exit 0, All checks passed
bandit -r sentinelai -ll -f txt                 -> exit 0, No issues identified
python -m pytest -q                             -> 255 passed, 7 subtests passed
both workflow YAMLs parse