container-scan is an orphan job: no aggregator consults its result

[hyperpolymath]

container-scan ("Container Security Scan") in
.github/workflows/security-policy.yml is consulted by no aggregator:

• security-status needs [rust-audit, rust-deny, secret-scan, codeql, sbom-rust] — not it.
• audit-summary needs audit_container-scan ("Container Security (Trivy)"),
  which is a different job.

So when container-scan fails, its failure reaches nothing. It was red on run
35772115983 and no rollup noticed. A job whose result is read by nobody is
either dead weight or an unmonitored gate; either way it should not exist in
that state.

(Its failure there was a missing security-events: write on upload-sarif,
fixed in #844 — but the orphaning is independent of that and survives the fix.)

Acceptance criteria

1. A decision: either container-scan is deleted, or it is wired into an
   aggregator's needs:.
2. If wired, a mutant proves it — force the job red and the aggregator goes
   red; revert and it goes green.
3. If deleted, the merge-order caution from the duplicated-tier issue applies:
   confirm no ruleset and no open PR requires its display name first.
4. A CI assertion that every job in this workflow except the aggregators
   themselves is named in some aggregator's needs: — so a future orphan is
   caught mechanically rather than by reading.

Found while fixing #844.