security: container + CI hardening — .dockerignore, SHA-pin actions, drop sudo/C_FORCE_ROOT, no-new-privileges (F-012..F-017)

security: container + CI hardening — .dockerignore, SHA-pin actions, drop sudo/C_FORCE_ROOT, no-new-privileges (F-012..F-017) #1000