Parallel trivy image workers sharing the fs cache directory hit
"cache may be in use by another process: timeout" errors. Switch to
--cache-backend memory to avoid bolt-db lock contention, matching the
approach already used in generate-sbom.sh.
Python was still reading DOCKERHUB_PAASUP_USER/TOKEN while the env:
block sets DOCKERHUB_USER/TOKEN, silently disabling private registry
auth. Also restore the nvcr.io (NGC) auth entry that was dropped.
Skip SBOM generation entirely since cve-edge-post.yml only needs
vulnerability counts, not CycloneDX artifacts — scan each image with
`trivy image` directly and aggregate with python3 (drop jq dependency).
Output is now a JSON array with one entry per image instead of a single
merged summary.
ychangkim