fix: match container-scan.yml's push paths to what actually reaches the image

The path filter only watched explorer/package.json and package-lock.json,
but Dockerfile COPYs the whole explorer/ tree plus README.md, LICENSE, and
MANIFEST.in, and .dockerignore controls all of it. A frontend source change
or a README/LICENSE edit would change the built image without triggering a
scan, silently drifting until the next weekly run. Replace the filter with
exactly .dockerignore's opt-in list.

.github/workflows/container-scan.yml

@@ -3,14 +3,18 @@ name: Container Security Scan
 on:
   push:
     branches: [main]
+    # Mirrors .dockerignore's opt-in list exactly - anything not listed there
+    # can't reach the build context, so it can't change the built image.
     paths:
       - 'Dockerfile'
+      - '.dockerignore'
       - 'pyproject.toml'
-      - 'requirements*.txt'
-      - 'explorer/package.json'
-      - 'explorer/package-lock.json'
+      - 'README.md'
+      - 'LICENSE'
+      - 'MANIFEST.in'
       - 'semantica/**'
       - 'integrations/**'
+      - 'explorer/**'
       - '.github/workflows/container-scan.yml'
   schedule:
     - cron: '30 2 * * 1'  # weekly, catches new CVEs published against the base image between pushes