[Tracking] Keep CI/CD dependency and runtime updates reproducible #2632

Objective

Make Auto-Coder CI/CD dependency and runtime updates reproducible and supportable. Preserve the Python 3.12 production baseline until a separately verified migration.

Context

Audit at main 5b64aa8 found an unlocked production Docker Python dependency resolution, inconsistent uv versions, Node.js 20 in the development image, and gaps in compatibility and update monitoring.

This parent coordinates five independently testable children; it has no implementation Requirements. #2634 owns the shared CI uv selection and lock-admission policy. #2633 consumes that admission setup while owning locked image packaging and runtime verification; #2636 consumes the selected uv/setup and lock policy while adding advisory Python 3.14 evidence. Their direct declarations are Blocked-By: #2634. #2634, #2635 (Node development/CI policy), and #2637 (update monitoring) remain independent roots with an empty Blocked-By: declaration. Completion is tracked in these children, with no additional parent implementation work.

Non-goals

Changing worker lifecycle, Docker runtime control, deployment authorization, or security threat model.