Pin ubuntu:22.04 to its current manifest digest to ensure
reproducible builds and prevent supply-chain mutations.
Closes#513
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Pin all FROM images in Dockerfile and dev/ci/Dockerfile to their
current SHA256 manifest digests for reproducible builds.
- rust:1.93-slim-trixie → @sha256:9663b80a...
- busybox:latest → busybox:1.37@sha256:b3255e7d...
- debian:trixie-slim → @sha256:f6e2cfac...
- gcr.io/distroless/cc-debian13:nonroot → @sha256:84fcd3c2...
- rust:1.92-slim → @sha256:bf3368a9...
Closes#359
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>