Add corgea scan --include-image to scan fully built container images

Cargo.toml

@@ -16,7 +16,7 @@ test-stub = []
 
 [dev-dependencies]
 corgea = { path = ".", features = ["test-stub"] }
-tempfile = "3.12.0"
+tempfile = "3.20.0"
 
 [dependencies]
 clap = { version = "4.4.13", features = ["derive"] }
@@ -40,7 +40,7 @@ serde_derive = "1.0.195"
 uuid = { version = "1.7.0", features = ["v4"] }
 which = "6.0.0"
 zip = "2.3.0"
-tempfile = "3.12.0"
+tempfile = "3.20.0"
 quick-xml = "0.41"
 ignore = "0.4"
 globset = "0.4"

skills/corgea/SKILL.md

@@ -41,6 +41,8 @@ corgea scan --fail                             # Deprecated: exit 1 based on eve
 corgea scan --out-format json --out-file r.json   # Export (json, html, sarif, markdown)
 corgea scan --sbom                             # Also write a CycloneDX SBOM to bom.json
 corgea scan --sbom sbom.cdx.json               # SBOM to a custom file
+corgea scan --include-image myapp:1.2.3        # Also scan a fully built container image
+corgea scan --include-image myapp:1.2.3 --include-image ghcr.io/acme/api:latest  # Repeatable
 corgea scan --project-name my-service          # Override project name
 ```
 
@@ -52,6 +54,10 @@ Scan types: `blast` (base AI), `policy` (PolicyIQ), `malicious`, `secrets`, `pii
 
 `--fail` is deprecated. It evaluates every active blocking rule regardless of what it applies to; use `--block-on` to name the CI rules a pipeline should enforce.
 
+`--include-image` scans the image you actually ship. Without it, container scanning discovers the base images referenced by Dockerfiles and Compose files in the repo and scans those. With it, each image is exported to a tar archive with `docker save` (or `podman save`), bundled with the project, and scanned as a whole — base-image discovery is skipped for that scan. Images that aren't available locally are pulled first, so build (or pull) the image before the scan and stay logged in to its registry. Set `CORGEA_CONTAINER_ENGINE` to choose a specific container CLI. Container scanning must be enabled for your account.
+
+An included image is enough on its own: when it is combined with `--only-uncommitted` or `--target` and no source files match (a clean working tree, for example), the scan warns and covers just the image rather than failing. An archive named `corgea-image-scanning-*.tar` that is committed to the repository is ignored — only images passed on the command line are scanned.
+
 `--only-uncommitted` and `--target` are mutually exclusive. `--fail-on`, `--fail`, and `--block-on` are mutually exclusive.
 
 ### Upload — `corgea upload [report]`
@@ -353,6 +359,13 @@ corgea scan
 corgea scan --only-uncommitted --fail-on HI
 ```
 
+### Scan the container image a build produced
+
+```bash
+docker build -t myapp:1.2.3 .
+corgea scan --include-image myapp:1.2.3
+```
+
 ### Scan a PR diff
 
 ```bash