fix(ci,device): drop workflow_dispatch ref input + narrow bare except in CPU info parser

[vpetersson]

Issues Fixed

Addresses two legitimate findings from a shoulder.dev security scan. The rest of the report was triaged as false positives (the upload path-traversal sinks are protected by uuid.*().hex + _SAFE_EXT_RE; the @authorized decorator covers the routes shoulder flagged as "missing authz"; mark_safe in asset_filters.to_json is preceded by JSON-encode and &<>' hex-escape; the open-redirect sink uses reverse() + url_has_allowed_host_and_scheme; etc.).

Description

• .github/workflows/marketing-screenshots.yaml — drop the workflow_dispatch inputs.ref. The GH UI's "Use workflow from" picker already sets github.ref for operator-triggered runs, so the explicit input only added capability to API callers — a stolen GITHUB_TOKEN with actions:write could otherwise dispatch this workflow against an attacker-supplied SHA / fork ref and execute it on a runner.
• src/anthias_common/device_helper.py — replace except Exception: pass in parse_cpu_info with an explicit split-length guard + continue. Also fixes a latent bug: under the old pass fall-through, a malformed /proc/cpuinfo line would land in the if key in [...]: cpu_info[key.lower()] = value block with value carried over from the previous iteration (or unbound on the first line).
• .gitignore — shoulder.dev's local cache directory.

Checklist

• I have performed a self-review of my own code.
• New and existing unit tests pass locally and on CI with my changes.
• I have done an end-to-end test for Raspberry Pi devices.
• I have tested my changes for x86 devices.
• I added a documentation for the changes I have made (when necessary).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[vpetersson-bot]

Superseded by #3217. That PR was opened from a stale worktree branch (2026-05); all three findings are still present on master, so I reimplemented them against current master (the actions/checkout pin has since advanced to v7.0.1) and added a regression test for the parse_cpu_info stale-value bug. Closing in favor of the fresh PR.

[vpetersson-bot]

Reimplemented as #3217 (built on current master — the actions/checkout pin has since moved to v7.0.1 — plus a regression test for the parse_cpu_info stale-value bug). All three findings here are still present on master, so this is superseded rather than obsolete.

Safe to close in favor of #3217 whenever you're ready — I don't have permission to close it from here.