advisory-scan: --image takes NAME=FROM:TO

Restores the single-value form (operator preference) under the --image name.
Repeat the flag per image, all in one call. Malformed values warn on stderr and
are skipped rather than aborting the scan, since it is an additive pre-step.

Counts unchanged: discourse 128 with redis / 123 without, gitea 2.

.claude/skills/recipe-upgrade/SKILL.md

@@ -164,7 +164,7 @@ into the per-recipe log**:
 
 ```
 python3 /srv/cc-ci/cc-ci-plan/advisory-scan.py <recipe> --from <old-app-version> --to <new-app-version> \
-        [--image <name> <old> <new>]...
+        [--image <name>=<old>:<new>]...
 ```
 
 **Pass an `--image` for EVERY sidecar you upgraded** (redis, postgres, nginx …), not just the app —
@@ -173,7 +173,7 @@ the flag for each one and pass them **all in a single call** (the count is a uni
 e.g. discourse moving app 3.5.3→2026.7.1 *and* redis 7.4→8.10:
 
 ```
-... --from 3.5.3 --to 2026.7.1 --image redis 7.4 8.10
+... --from 3.5.3 --to 2026.7.1 --image redis=7.4:8.10
 ```
 
 → 128 CVEs (123 app + 5 redis), where the redis five include a **critical** (CVE-2025-49844) that is