harden production container supply chain

[nikitacometa]

What changed

• replace the digest-pinned Debian runtime with digest-pinned Python 3.12 Alpine;
• convert the container entrypoint to portable POSIX sh;
• add a digest-pinned Trivy image gate to CI;
• document the hardened runtime and update the container milestone.

Why

A fresh vulnerability database reported unfixed high/critical findings in the
previous Debian base. The selected Alpine base has no high/critical OS or Python
package findings and reduces the production image from about 210 MB to 115 MB.

Verification

• make quality — 168 tests, 80.65% focused coverage, Ruff and strict mypy;
• cold multi-stage Docker build from the pinned digest;
• non-root runtime/import/status smoke and pip check;
• Trivy 0.72.0 — 0 high/critical vulnerabilities and 0 secrets;
• focused multi-agent Docker/CI review — no blockers.

No API contract, database schema, or frontend behavior changes.