Handle shadowed gosu scan finding

scripts/scan_container_image.sh

@@ -39,7 +39,9 @@ docker run --rm \
   "$TARGET_IMAGE"
 
 # Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
-# remain visible in the full report and must be reviewed before release.
+# remain visible in the full report and must be reviewed before release. The
+# postgres base image's Go gosu binary remains discoverable in a lower layer,
+# but the final filesystem replaces it with the audited setpriv shell wrapper.
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v "$CACHE_DIR:/root/.cache/trivy" \
@@ -51,6 +53,7 @@ docker run --rm \
   --skip-version-check \
   --ignore-unfixed \
   --ignorefile "$CONTAINER_IGNORE_FILE" \
+  --skip-files /usr/local/bin/gosu \
   --severity HIGH,CRITICAL \
   --exit-code 1 \
   "$TARGET_IMAGE"