A rogue release in a CI/CD security plugin shows why build systems now have to trust their tools less, not more.