Point documented tag references at a release that exists

[haksungjang]

The repository has been recreated twice, and each recreation dropped the tags that came before it. Only v0.20.0 and later resolve today. The documentation did not move with them, so the CI-integration and installation guides still pinned their copy-paste examples to v0.10.0: uses: trustedoss/trusca/actions/scan@v0.10.0 failed with "unable to resolve action", and the GitLab include: remote: URL, the curl quick install and git checkout v0.10.0 all returned 404. Twenty-eight places in English and Korean, and they are the first thing an evaluator runs. The composite action's README and the workflow template pointed at trustedoss/scan-action, which is not a repository at all; both now name the in-repo trustedoss/trusca/actions/scan path. The "pin to a commit" example used an invented six-character SHA and is now the real commit v0.22.4 points at. All five previously-404 fetches return 200 on the rewritten URLs.

Editing the values would fix today and nothing else, so tools/release-refs derives the release from the newest ## [X.Y.Z] section in CHANGELOG.md and checks every reference against it. Tag-shaped refs into this repository are found by pattern, so a reference written later is covered the day it is written; main, a full commit SHA and an angle-bracket placeholder pass, and prose like "v0.10.0 removed Dependency-Track" deliberately does not match, because rewriting history would make the sentence false. Bare literals a pattern cannot tell from any other number are listed in pins.json: the chart version and appVersion, the chart's image.tag default, the README badge, the Helm values table and its Korean mirror. --fix rewrites only the line a finding sits on, since a whole-file replace would also rewrite the same digits where they mean something else.

The gate runs in lint (frontend), a required check, and in scripts/release.sh before the tag is created, so a release cannot be cut while the guides name the previous one. A selftest runs first, for the reason the license-header one does: a pattern that silently matches nothing reports clean. It carries the miss found while writing this change, where the URL pattern required a trailing slash and so never saw BASE=https://raw.githubusercontent.com/trustedoss/trusca/v0.10.0.

.env.example (IMAGE_TAG=0.22.0), the docker-compose.yml fallback (0.12.0, ten minors behind) and the Compose guide sentence that stated that default are listed under pending in pins.json rather than fixed here, because PR #285 and two open worktrees hold those files. The linter prints them as a notice; moving each entry up into pins is the whole of the follow-up. Verified locally: release-refs lint and selftest, ko-style --all --fail-on S2 (0 findings), em-dash on the staged diff, license-header --all, docs-uat extract --lint (0 errors), shellcheck --severity=warning, helm lint, and a full docs-site production build.