chore(deps): update Checkov action

[rldyourmnd]

Summary

Update the reusable IaC scanner from bridgecrewio/checkov-action v12.1347.0 to v12.3112.0 using the exact upstream commit. Keep the machine catalog and changelog in lockstep, and promote iac-scan.yml to runtime-proven from the isolated proof run https://github.com/NDDev-it-com/nddev-ci-workflows/actions/runs/29260835832.

The action update also changes the bundled Checkov engine from 2.0.930 to 3.3.6. The live proof scanned an intentionally unsafe Terraform fixture, reported seven CKV findings, and honored soft_fail: true.

Type of change

• New reusable workflow / capability
• Fix to an existing workflow
• Pinned tool/action version bump
• Hardening / security posture improvement
• Docs only

Threat-model note (required for workflow / permission changes)

The executable dependency changes to exact action commit a7683e7b72a04503521247973281ec8142e1ac1f. Its bundled engine image is ghcr.io/bridgecrewio/checkov:3.3.6; that nested mutable tag is an upstream residual supply-chain risk and is recorded in the changelog. The outer action stays immutable, no new credentials or inputs are introduced, and an isolated live workflow_call verified the expected scanner behavior before this PR.

Permissions diff (required for workflow / permission changes)

None. Top-level permissions: {} and job-level contents: read are unchanged.

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a version comment.
• Least-privilege permissions remain unchanged.
• Existing concurrency and timeout contract remains unchanged.
• Read-only checkout keeps persist-credentials: false.
• No expression is interpolated inside run:.
• Tier separation remains unchanged.
• actionlint passes locally.
• zizmor --persona regular --min-severity low .github/workflows passes locally.
• Catalog, runtime ledger, and changelog are updated; generated docs have no drift.
• Commit is signed and carries DCO sign-off.

Tier impact

• Public
• Private free tier
• Private paid tier

Validation

• python3 scripts/validate_all.py
• python3 scripts/generate_docs.py --check
• actionlint
• zizmor --persona regular --min-severity low .github/workflows
• git diff --check