fix(ci): unblock nightly deep assurance workflow

[TensorGymnastic]

Summary

• pin the nightly mutation-testing job to mutmut<3 so the workflow keeps the CLI surface it currently uses
• run mutmut with an executable workspace-backed TMPDIR so the fake codex binary integration test can execute on GitHub runners
• correct the Trivy action reference to the tagged release name GitHub can resolve

Validation

• TMPDIR=/workspace/dev/t_815809ef/CodeWiki/.tmp-mutmut pytest tests/test_enduser_review_integration.py::test_enduser_review_with_fake_binaries_on_path -q -vv
• TMPDIR=/workspace/dev/t_815809ef/CodeWiki/.tmp-mutmut timeout 75 python -m mutmut run --paths-to-mutate codewiki/src/enduser --no-progress --CI (baseline passed; mutant execution continued until timeout)
• confirmed aquasecurity/trivy-action has a v0.30.0 tag, while the previous unprefixed 0.30.0 reference fails action resolution