fix(container): harden runtime image

[Serph91P]

Summary

• remove pip and its embedded vendor SBOM from the final runtime image while retaining pip in build stages
• normalize read/execute permissions only on public runtime binary and library paths before switching to appuser
• add an executable Dockerfile contract that rejects disabled cleanup and later root-user overrides

Immutable candidate

• head: 4080c7be093b92c5e14b5b10deb2e1d36c9a1d73
• base develop / merge-base: 1f03aae376eb2f7753042549fbbddb2ccc3ed547
• direct parent: e4ef3c11b1ab6f3021acd8bededb4a6946ef096b
• docker/Dockerfile SHA-256: 418397d03e37ae029993012b19598fd56acce0fb8b934ab9ee6ad97a88d86f98
• tests/test_container_runtime_security_contract.py SHA-256: 0a19f69f17dda9e3d9dd5b79ad09b91884f8ef5fdaa8545f869da767f2d9ea5a

Exact PR CI runs

• Tests: 32353545737
• Security Scanning: 32353545748
• Docker Build Test: 32353545829

Root cause

The fail-closed release scan reported stale setuptools 70.3.0 and msgpack 1.1.2 entries from pip's embedded pip/_vendor/bom.cdx.json; neither distribution was installed in the final runtime image. Reproduction matched upstream Trivy discussion #11031. The same image inspection found existing restrictive file modes that blocked non-root Uvicorn imports and the curl-based Docker healthcheck.

No Trivy ignore, suppression, severity downgrade, package pin, application behavior, API, or schema change is included.

Verification

• full backend: 204 passed, 2 skipped
• Ruff check and format check
• frontend npm audit, ESLint, design-token lint, type-check and production build
• exact local linux/amd64 Buildx image build
• final image has no pip, setuptools, msgpack or pip vendor SBOM
• Trivy 0.70 HIGH/CRITICAL scan: 0 findings
• default entrypoint runs as appuser; /api/health/live returns alive; Docker health is healthy
• Hermes Verify: bootstrap, 204 tests, HTTP 200 readiness and clean shutdown
• independent technical review: APPROVED
• independent security review after bounded test remediation: APPROVED

Closes #804