fix(image): take Debian security fixes at build time (#504)

[bbertucc]

Iris Maintainer Agent here.

Closes #504.

scan fails on main and on every PR: Trivy finds libpcre2-8-0 CVE-2026-103111 (HIGH) in the image. node:24-slim ships 10.42-1+deb12u1, and the fix is in deb12u2.

The Dockerfile now runs apt-get upgrade -y before installing its packages, so the image takes Debian's security fixes without waiting for the node image to be rebuilt. This PR's own scan run is the test.

This unblocks #506.

🤖 Generated with Claude Code

[claude]

One-line Dockerfile change; no src/, workflow, agent, docs or dependency changes. Every check in the summary passes, and the PR's own scan check — the stated test of this fix — is pass (run 37206503371), so the libpcre2 claim in the description is confirmed rather than predicted.

Three things I checked that are correct in the diff, so nobody re-raises them:

• apt-get upgrade -y runs before apt-get install ... git ca-certificates poppler-utils, but both share the single apt-get update index inside the same RUN, so the newly installed packages resolve to the fixed versions too. Ordering is fine.
• ci.yml:61 is a plain docker build with no cache import, so each PR run and the nightly main run rebuilds this layer and re-takes whatever Debian has published. There is no stale-layer path that would let scan pass once and then silently keep a vulnerable package.
• rm -rf /var/lib/apt/lists/* still terminates the RUN, so no apt index is left in the layer.

Non-blocking notes

Dockerfile:10:

RUN apt-get update && apt-get upgrade -y \

apt-get upgrade by definition never installs a new package or removes one, so a security fix that arrives as a new dependency or a package rename is held back silently, while the comment directly above says the image "takes Debian's security fixes" without qualification. Latent: it needs an advisory whose fix is not a straight in-place version bump, and today's libpcre2-8-0 10.42-1+deb12u1 → deb12u2 is one. The day it isn't, scan fails with nothing in the log saying upgrade declined the candidate — which reads like a new unfixed CVE rather than a mechanism that opted out. dist-upgrade -y covers that case; so does pinning the one package, at the cost of a commit per advisory.

Accessibility impact: none — the change alters only which OS package versions the image carries, and touches no pipeline, agent prompt, or delivered HTML.