reassess the expired npmplus packaging-tool baseline

[mangyan1]

Why

GitHub shows "Code scanning configuration error: Trivy is reporting errors" because the nightly Container Security run (37197521164) failed its Enforce reviewed baseline step: all four reviewed exceptions in .trivy/npmplus.yaml expired on 2026-10-04, resurfacing four HIGH findings in ghcr.io/mangyan1/npmplus:develop@sha256:e9e90bc2:

finding	package	installed	fixed
CVE-2025-47273	setuptools (metadata only)	70.3.0	78.1.1
GHSA-6v7p-g79w-8964	msgpack (pip vendored)	1.1.2	1.2.1
CVE-2026-97687	urllib3 (pip vendored)	2.7.0	2.8.0
CVE-2026-97689	urllib3 (pip vendored)	2.7.0	2.8.0

What changed

Re-review pass per the convention from 71edac2:

• Statements re-dated to the 2026-10-04 recheck: pip 26.2.1 is still the latest release (verified against PyPI) and still vendors urllib3 2.7.0 / msgpack 1.1.2; the setuptools finding remains metadata-only; the separately installed Certbot urllib3 stays pinned to patched 2.8.0. None of the awaited upstream fixes have shipped, so acceptance continues per the 2026-09-05 owner decision (AGENTS.md §Container CVE policy).
• Scan digest header updated to the scanned develop image.
• Expiry extended to 2026-10-11: the prior two-day window predated any pip release cadence and only forced same-day re-reviews; seven days matches the repo's minimumReleaseAge philosophy while keeping the exceptions short-lived.

Not touched

• .trivy/crowdsec.yaml / .trivy/anubis.yaml — referenced by no workflow; historical upstream baselines.
• The two MEDIUM findings (CVE-2026-59890 setuptools, CVE-2026-97688 urllib3) — below the HIGH,CRITICAL gate; recorded in the scan JSON artifact.
• No Dockerfile changes: certbot's urllib3 is already 2.8.0; the flagged copies are pip's vendored modules, which the owner decision leaves unmodified.

Verification

The docker-develop PR job builds the image from this branch and enforces this baseline with --exit-code 1 at HIGH,CRITICAL — a green Scan pull-request image step is the proof. Merging before the next scheduled Container Security run (05:17 UTC) clears the code-scanning banner.