[Copilot]

docker run was emitting image pull output inline, which pushed actionable zizmor output out of view in step logs. This change isolates pull noise into a collapsible GitHub Actions log group while preserving existing execution flow.

• Log output shaping

  • Added an explicit image pull step wrapped in GitHub Actions group markers so pull chatter is collapsed by default.

• Runtime flow adjustment

  • Kept the same resolved image reference (tag@digest) and existing docker run invocation; only moved pull output into a dedicated section.

echo "::group::Pulling zizmor image"
docker pull "${image}"
echo "::endgroup::"

docker run \
  --rm \
  ... \
  "${image}" \
  ...