QODY CI-CD pipeline fixes 2026-07-08 (MC 105057+105059)

QODY CI/CD demo pipeline fixevi — 2026-07-08 (MC #105057 + #105059)

Dokazano zelenim pipeline run #330 (commit 747c100, deployDemo=true). John live-verifikovao timeline + endpointe; Proveo nezavisna tool-verifikacija PASS.

Kontekst

Run #328 (buildx fail) i raniji Trivy fail (#327) blokirali QODY demo deploy. Oba uzroka su bili pre-postojeće pipeline rupe, ne aplikacijski/Monri kod.

Fix #105059 — idempotent buildx (Build_Images)

Simptom: run #328 Build_Images ERROR: existing instance for "qody-builder" but no append mode.
Uzrok: azure-pipelines.yml demo stage (lin 881) radio goli docker buildx create --use --name qody-builder; persistent self-hosted agent (qody-forge-1) zadrži builder instancu između runova → kolizija.
Fix: backport idempotentnog patterna s prod stagea (MC #104911): docker buildx use qody-builder 2>/dev/null || docker buildx create --name qody-builder --use --driver docker-container (lin 886).

Fix #105057 — Trivy verify-not-fetch (Security_Image_Scan)

Simptom: Trivy install pao na qody-forge-1: mkdir /usr/local/bin: Permission denied.
Uzrok: curl-based installer piše u /usr/local/bin, koji ne postoji na Apple Silicon self-hosted agentu i traži sudo (kojeg agent nema).
Fix: verify-not-fetch — koristi već-instalirani Homebrew Trivy 0.72.0 (export PATH="/opt/homebrew/bin:$PATH"; which trivy), isti pattern kao druga dva Trivy stepa (MC #104917). FORGE agent nije diran.

Dokaz (run #330)

Stage	Rezultat
CI Gates	succeeded
Build_Images → ACR	succeeded (buildx fix radi)
Security: Trivy image scan (4 images)	succeeded (Trivy fix radi)
Deploy → QODY demo ACA	succeeded
Deploy_Prod	skipped (ispravno — nije main)

Timeline: 165 succeeded / 0 failed / 6 skipped (prod).

Live (John curl): demo.api.qody.ba/health → 200 (db.connected, RLS PASS); demo.app.qody.ba → 200.

Evidence: ~/system/evidence/105048/pipeline-330-timeline.json + verdict-105057.json + verdict-105059.json