R-1303: every pin names its security-notice source (upstream.txt, # upstream: above each FROM); gate upstream + decoys. No runtime change.

controller/infra-images/samba/Dockerfile

@@ -24,6 +24,7 @@
 #             Evidence: felhom.eu/documentation/audits/DIAG-sharing-2026-07-20.md.
 # 1.2.0 (R-972): Alpine 3.24.2, pinned by digest — the same base as the hub. 3.21 carried 48 fixable high findings
 # (audits/security-review-2026-10-12/scanners/). Same packages; scanner before → after in the controller's v0.323.0 CHANGELOG.
+# upstream: gap:Alpine's package fixes (Samba among them) are in its secdb, which the watch does not read; BEHIND on the point release is the signal
 FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
 
 # samba = smbd + nmbd + smbpasswd/testparm (meta-package proven installable in the spike);