[SandObserver]

Summary

• Delete setuptools, setuptools-*.dist-info, _distutils_hack and distutils-precedence.pth from site-packages inside the same RUN that installs nginx and supervisor. A later layer would leave the files present in the install layer, which is where the image and the scanner still carry them.
• Assert the removal in the build: python3 -c 'import setuptools' must fail, and supervisord --version must still succeed, so a path that stops matching after a base image bump fails the build instead of silently removing nothing.
• Add three tests to api/test/image-hardening.test.js covering the removed paths, the removal staying in the install layer, and the two build-time proofs.
• Add a [Unreleased] → Security entry.

Why removal rather than an upgrade or an exception: apk del refuses because supervisor declares the dependency, but supervisor has not needed setuptools at runtime since Python 3.8 and this image is Python 3.14. The Alpine package was unpacked to confirm it ships no pkg_resources, so nothing can be importing it from there. Nothing in the image runs pip.

Testing
All green. Added 3 tests; mutation-checked by moving the deletion into its own layer and by disabling the import check, each of which fails. The build-time assertions and the container boot are verified by CI: the docker build smoke test, and the e2e job, which starts the image and waits on /health — supervisord failing to start would fail there.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.