fix(build): three drill-driven fixes so the lane actually completes on a starter node

The first live build (Kaniko v1.24, 4 vCPU / 5.5 GiB node) walked the new
transport end to end and hit three real defects, each invisible to unit tests:

- The Job requested its FULL limits (2 CPU / 4Gi per container), so the build
  Pod never scheduled on the platform's own starter node: FailedScheduling /
  Insufficient memory, Pending forever. Requests are now a small floor
  (250m / 512Mi, never above a configured cap) while the limits stay the
  safety caps.
- Kaniko re-copies the Dockerfile out of the context and chowns/chmods it to
  the source owner; a 65532-owned context (the distroless felis image uid)
  fails that under the pod's dropped capabilities ('copying dockerfile:
  chown /kaniko/Dockerfile: operation not permitted'). The fetch container
  now extracts as root — the uid Kaniko already runs as — so the copy
  succeeds; the pod was root by necessity regardless.
- Trivy's DB fetch is exactly what the build egress lock denies: the scan
  step failed closed on mirror.gcr.io. New [registry] trivy_db_repository
  renders --db-repository, and docs/troubleshooting.md §8e now carries the
  verified mirror recipe (docker pull/tag/push of aquasec/trivy-db:2 into the
  internal registry; --insecure already covers its plain HTTP).

Verified live after this batch: fetch initContainer streamed the blob through
the API + netpol + token, Kaniko built and pushed registry.felis.svc:5000/
user-uploads/sub-<id>:latest, and Trivy scanned against the mirrored DB.

internal/build/build.go

@@ -220,6 +220,11 @@ type Config struct {
 	// only when a build's ContextRef is an http(s) URL (the submit lane's derived
 	// shape); an install that never builds user submissions can leave it empty.
 	FelisImage string
+	// TrivyDBRepository overrides where Trivy fetches its vulnerability DB
+	// (--db-repository). Empty keeps Trivy's upstream default, which the build
+	// egress lock denies — an install with builds must point this at an internal
+	// mirror (see config.RegistryConfig.TrivyDBRepository).
+	TrivyDBRepository string
 	// KanikoImage / TrivyImage are the executor images.
 	KanikoImage string
 	TrivyImage  string
@@ -354,18 +359,19 @@ func (b *Builder) Submit(ctx context.Context, req Request) (*Build, error) {
 // jobParams projects a build + config onto the inputs jobspec.go renders.
 func (b *Builder) jobParams(bld *Build, cfg Config) JobParams {
 	return JobParams{
-		BuildID:        bld.ID,
-		ImageRef:       bld.ImageRef,
-		ContextRef:     bld.ContextRef,
-		Namespace:      cfg.Namespace,
-		ServiceAccount: cfg.ServiceAccount,
-		RegistryURL:    cfg.RegistryURL,
-		FelisImage:     cfg.FelisImage,
-		KanikoImage:    cfg.KanikoImage,
-		TrivyImage:     cfg.TrivyImage,
-		Deadline:       cfg.Deadline,
-		CPULimit:       cfg.CPULimit,
-		MemLimit:       cfg.MemLimit,
+		BuildID:           bld.ID,
+		ImageRef:          bld.ImageRef,
+		ContextRef:        bld.ContextRef,
+		Namespace:         cfg.Namespace,
+		ServiceAccount:    cfg.ServiceAccount,
+		RegistryURL:       cfg.RegistryURL,
+		FelisImage:        cfg.FelisImage,
+		TrivyDBRepository: cfg.TrivyDBRepository,
+		KanikoImage:       cfg.KanikoImage,
+		TrivyImage:        cfg.TrivyImage,
+		Deadline:          cfg.Deadline,
+		CPULimit:          cfg.CPULimit,
+		MemLimit:          cfg.MemLimit,
 	}
 }