fix: harden CLI execution and runtime reliability

[Patel230]

Summary

• Harden SQL execution, workspace DSNs, WAL durability, SSE responses, Docker user handling, and CLI JSON output.
• Add daemon health/docs wiring, deterministic home-path tests, and secure Trivy gating.
• Pin container base images, publish the daemon image, and fix OpenAPI validation wiring.
• Refresh GitNexus project guidance in AGENTS.md and CLAUDE.md.

Validation

• Full go test suite passed.
• go vet and govulncheck passed.
• Boundary guards and pre-commit hooks passed.
• GitNexus staged checks passed.
• OpenAPI lint passed with non-blocking style warnings.

Docker image build verification remains for CI because no local Docker daemon was available.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.