fix(code-scanning): stamp report timestamps in UTC

datetime.now() returned a naive timestamp, so `generated_at` in the code
scanning report carried no offset and a reader could not tell which zone
it was written in. Use datetime.now(timezone.utc) for both the report
field and the fallback output directory name.

The changelog keeps date.today(): a release entry carries the author's
local calendar day, so UTC would be wrong there. The rule is suppressed
with that reason instead.

This is the last lint finding; `ruff check src tests` now passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/pkgmgr/actions/code_scanning/__init__.py

@@ -14,8 +14,8 @@ import shutil
 import subprocess
 from collections import Counter
 from dataclasses import dataclass, field
-from datetime import datetime
-from typing import Any, List, Optional
+from datetime import datetime, timezone
+from typing import Any
 
 
 class CodeScanningError(RuntimeError):
@@ -123,18 +123,18 @@ def download_code_scanning(
     repo_name = repo.rstrip("/").split("/")[-1]
 
     if output_dir is None:
-        timestamp = datetime.now().strftime("%Y%m%d%H%M%S")
+        timestamp = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
         output_dir = os.path.join("/tmp", repo_name, "code-scanner", timestamp)
     output_dir = os.path.abspath(os.path.expanduser(output_dir))
     os.makedirs(output_dir, exist_ok=True)
-    generated_at = datetime.now().isoformat(timespec="seconds")
+    generated_at = datetime.now(timezone.utc).isoformat(timespec="seconds")
 
     alerts = _fetch_json(
         f"repos/{repo}/code-scanning/alerts",
         params=[f"state={state}"] if state else None,
     )
 
-    files: List[str] = []
+    files: list[str] = []
 
     def _write(name: str, content: str) -> None:
         path = os.path.join(output_dir, name)

src/pkgmgr/actions/release/files/changelog_md.py

@@ -63,7 +63,7 @@ def update_changelog(
     missing) and above any existing release entries, so the result stays
     markdown-lint-clean (MD041 first-line-h1, MD012 no-multiple-blanks).
     """
-    today = date.today().isoformat()
+    today = date.today().isoformat()  # noqa: DTZ011 - changelog dates are local calendar dates
 
     def _entry_for(raw: str) -> tuple[str, str]:
         body = transform_changelog_message(raw).strip() or f"Release {new_version}"