[alvaroloes]

What changes

Fix runner image publication blocked by vulnerable embedded containerd copies and cached Debian packages:

• Build containerd 2.3.6 from a checksum-pinned source and replace the module embedded in Docker Engine, Buildx and Compose. The executable metadata audit rejects old, missing or substituted copies in each consumer.
• Refresh the cached Debian layer and require Chromium/chromium-common >=155.0.8059.79-1deb13u1 and libexpat1 >=2.9.0-1deb13u1.
• Add regression coverage and document the security floors.

Why

The release scan after #462 still fails on these packages. Updating only the standalone containerd executable leaves the embedded copies affected by GHSA-p7v4-vr35-mj6f.

Verification

• Required CI passes: complete pnpm verify, minimum Node 22, clean self-host image build and Docker-backed workspace E2E (11 tests in 3 files).

• Official candidate images: all three image builds and the existing Grype fixable-high/critical gate pass for commit a1365d3. No scanner exceptions or gates changed.

• Local: 15 focused image tests, all 153 script tests in serial, 8 package test tasks, guards, unused checks and the dependency audit pass under its existing policy.

• Local pnpm verify passes lint, typecheck, clean build and critical integrations, then hits the unchanged 1.5-second image-size ICNS child-startup timeout under parallel scripts. All three image-size cases pass alone. Timeouts and assertions are unchanged. The local Docker build also hits a refused proxy.golang.org connection; the complete image builds and workspace acceptance pass in CI.

• pnpm verify passes locally (parallel startup timeout above)

• pnpm verify passes in CI

• Behaviour verified beyond the unit suite: real image build, vulnerability scan and Docker workspace E2E

• Documentation updated

Patch release for the workspace image. No application/schema, credentials, permissions, budget or persistence-contract changes. Existing workspaces keep their selected images. Candidate publication uses SHA tags and does not deploy an installation.