Shrink the runtime base images to cut CVE surface (distroless / Chainguard / trimmed Debian)

[elronbandel]

Problem

The fleet's runtime bases (core/benchmark-base-*, debian-slim) ship packages most images don't use — perl, expat, ncurses, sqlite, libssh2, jq, … — each of which is CVE surface. The trivy image gate re-flags new HIGH/CRITICAL CVEs in these on every base rebuild, and many never get an upstream fix.

#243 made the gate fire on fixable CVEs only (--ignore-unfixed) — the right gate-sanity move — but it treats the symptom: it stops looking at no-fix CVEs rather than reducing them. The durable fix is to shrink the base.

Durable fix

Cut the package count in the bases so there's less CVE surface (fixable or not):

• Evaluate distroless / Chainguard-Wolfi / aggressively-trimmed Debian for the runtime bases.
• Drop incidental packages — the .github/.trivyignore history (perl/expat/ncurses/sqlite/libssh2) suggests several are transitive, not actually needed.
• Keep what's genuinely used: jq (eval-materialize-task), curl (dataset/gateway downloads), gettext-base.

Companion items

• Restore no-fix visibility (deliberately traded away by fix(security): trivy image gate fires on fixable CVEs only (--ignore-unfixed) #243): a scheduled, non-gating full scan — run trivy image directly without --ignore-unfixed, or add an opt-in path back to trivy.sh — so no-fix CVEs, including reachable CRITICALs, stay visible without blocking releases.
• Prune .github/.trivyignore once fix(security): trivy image gate fires on fixable CVEs only (--ignore-unfixed) #243 lands: it's now ~entirely redundant no-fix entries; keep only the deferred-fixable cases (otel 0.105.0 pin, litellm-wolfi, npm-bundled undici).

Context

Surfaced by the faster-bifrost republish (release run 28368018989), whose release-gate failed on 6 rebuilt bases over no-fix jq CVE-2026-49839 + libssh2 CVE-2026-55200 (CRITICAL) / 55199.