[SandObserver]

Summary

• Update the py3-setuptools note in the Dockerfile with the versions it was checked against on 2026-08-09: node:24-alpine resolves to Alpine 3.24.1, whose py3-setuptools is 82.0.1-r1, below the 83 that fixes CVE-2026-59890.
• Record that Alpine edge already carries 83.0.0-r0, so the finding clears when the base image floats onto the next stable Alpine, and state that this is why FROM names a tag rather than a digest.
• No build change. The finding remains a medium (6.1) with no fixed Alpine package, and the release scan gates on HIGH and CRITICAL with ignore-unfixed, so it neither fails a build nor blocks a release.

Testing
All green. No new tests: a comment change, with no build or runtime effect.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.