fix(ci): scan config.json echo escaping (trivy DB download fails)

Manual merge — NO auto-merge. Verify scan jobs pass before merging (allow_failure jobs matter).