Registry metadata (version, publisher, checksum) moves to a distinct fact strip.
Decline button renamed to say the run continues; reason capped to one sentence.
trivy 0.74.0 pinned with per-platform digests so request_tool can install it.
tfsec is deprecated upstream; the bundle now drives trivy config instead.
Sidecar inherits the login shell's env; toolchain resolves absolute paths with pinned
installs; request_tool replaces the 'tool missing -> STOP' instruction that hid a check.