feat(preflight): block cloud metadata range in target URL check (#337)

* chore(docker): pin temporal image to 1.7.0

* feat(preflight): block link-local metadata range in target URL check

* style: apply biome formatting and import sorting

apps/worker/src/temporal/pipeline.ts

@@ -5,7 +5,7 @@
  * within their own workflow context.
  */
 
-export { pentestPipeline } from './workflows.js';
+export type { ActivityInput } from './activities.js';
 export type {
   AgentMetrics,
   PipelineInput,
@@ -14,4 +14,4 @@ export type {
   ResumeState,
   VulnExploitPipelineResult,
 } from './shared.js';
-export type { ActivityInput } from './activities.js';
+export { pentestPipeline } from './workflows.js';