How to refresh Trivy’s vulnerability DB with update-trivy-db or an offline bundle on air-gapped hosts—and how to roll the whole cache directory back when an import fails.