fix: resolve container scan findings

[GethosTheWalrus]

Summary

• remove build-only packaging tools from the application virtual environment
• remove the base image's system pip installation from the runtime stage
• update scheduled OSV scanning to v2.5.0

Verification

• built the updated container image successfully
• verified application runtime imports and CLI startup
• scanned the final image with Docker Scout: 0 critical, high, medium, or low vulnerabilities
• verified Dependabot alerts and security updates are enabled for the repository

[github-actions]

Security Scan Results

Updated for commit a06a13d after a security scan completed.

Scanner	Check	Result
OSV dependency scan	✅ success (details)	OSV PR check completed; open details for vulnerability status.
CodeQL	✅ success (details)	No open CodeQL alerts reported for this PR ref.
Docker Scout	✅ success (details)	No open critical/high fixable container CVEs reported for this PR ref.

This comment is updated automatically as OSV, CodeQL, and Docker Scout finish for the PR.