fix(container): apt-get upgrade in the base layer to pick up OS security fixes

Nothing in container/Dockerfile pins a version (gh, docker-ce-cli and
Node come from their apt repos, pnpm/Playwright/uv/ruff/rustup/Claude
Code/AWS CLI resolve latest), so a rebuild is what delivers fixes. Two
things stood in the way:

- `apt-get install` never upgrades packages the ubuntu:24.04 image
  already ships, so a noble-security fix stays out until Canonical
  refreshes the tag. The first apt layer now runs `apt-get upgrade -y`
  inside the existing retry pattern.
- CI builds with `cache-from: type=gha`, so the layers only re-run when
  the base digest or a layer's text changes. Trivy on the published
  image (built 2026-10-16) found libbrotli1 1.1.0-2build2
  (CVE-2026-111497, HIGH), zlib1g 1.3.dfsg-3.1ubuntu2.2 (CVE-2026-85091)
  and pnpm's bundled undici 6.29.0 (CVE-2026-109383, CVE-2026-109869,
  CVE-2026-87018, all HIGH). Changing this layer invalidates the cache
  once, so the next CI build rebuilds everything.

A local `docker build --pull` of this tree succeeds (amd64). Trivy finds
no fixable OS or Node vulnerabilities in it: Node 22.23.4, gh 2.103.3,
docker CLI 29.9.2, AWS CLI 2.39.3, pnpm 12.16.1, Playwright 1.64.1,
Claude Code 2.1.316. What remains is uv 0.13.6's bundled rustls 0.23.45
(GHSA-c8m5-c952-6cm4, MEDIUM). That is fixed on uv's main branch but not
in a release yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

container/Dockerfile

@@ -28,12 +28,26 @@ ENV DEBIAN_FRONTEND=noninteractive
 # archive.ubuntu.com returns stale Packages.gz files with mismatched hashes
 # during hourly resyncs. Clearing /var/lib/apt/lists/* between attempts
 # forces a fresh fetch.
+#
+# `apt-get upgrade` is what picks up security fixes for packages the
+# `ubuntu:24.04` image already ships. `install` below never touches those, so
+# without it a fix that lands in noble-security between two refreshes of the
+# base tag stays out of this image until the next refresh. Packages the later
+# layers install come straight from the archive, so this one upgrade is enough.
+#
+# Note CI builds with `cache-from: type=gha`, so this layer (and everything
+# after it) only re-runs when the base digest or this layer's text changes.
+# Scanned on 2026-11-02, the published image of 2026-10-16 carried
+# libbrotli1 1.1.0-2build2 (CVE-2026-111497, HIGH) and zlib1g 1.3.dfsg-3.1ubuntu2.2
+# (CVE-2026-85091), both with fixed versions in the archive, and pnpm's bundled
+# undici 6.29.0 (three HIGH CVEs, fixed in the pnpm 12.16.1 a rebuild installs).
 RUN for i in 1 2 3 4 5; do \
         apt-get -o Acquire::Retries=3 update && break; \
         echo "apt-get update failed (attempt $i), retrying in 10s..."; \
         rm -rf /var/lib/apt/lists/*; \
         sleep 10; \
     done \
+    && apt-get -o Acquire::Retries=3 upgrade -y \
     && apt-get install -y --no-install-recommends \
     git \
     curl \