R-972: Go 1.27.2, x/crypto v0.58.0, debian 13.7-slim — pinned by version and digest

Go 1.24 had no security fixes left; the shipped binary carried 62 known Go vulnerabilities and the
bookworm base 12 fixable criticals. Full suite green on Go 1.27.2 (i18n parity included).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/Dockerfile

@@ -5,7 +5,9 @@
 # =============================================================================
 
 # --- Build stage ---
-FROM golang:1.24-bookworm AS builder
+# R-972 (v0.322.0): a supported, patched Go and the current Debian stable, pinned by version AND digest (no moving tag).
+# Go 1.24 had no security fixes left (go.dev/doc/devel/release#policy); bookworm-slim carried 12 fixable criticals.
+FROM golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e AS builder
 
 ARG TARGETOS=linux
 ARG TARGETARCH
@@ -39,7 +41,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
     ./cmd/controller/
 
 # --- Runtime stage ---
-FROM debian:bookworm-slim
+FROM debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
 
 # Install runtime dependencies:
 # - docker-cli: for "docker compose" commands
@@ -79,7 +81,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Install docker-cli (without daemon)
 RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg \
     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] \
-       https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list \
+       https://download.docker.com/linux/debian trixie stable" > /etc/apt/sources.list.d/docker.list \
     && apt-get update \
     && apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin \
     && rm -rf /var/lib/apt/lists/*