### mutation: restic back in the runtime apt list
=== RUN   TestR1105_ResticIsPinnedOutsideTheOS
    r1105_dockerfile_restic_test.go:71: the runtime's apt list installs restic — a second, OS-chosen restic: "apt-get install -y --no-install-recommends ca-certificates curl gnupg git util-linux rsync restic openssh-client"
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/cmd/controller	0.011s
FAIL
### mutation: docker repo codename hard-coded
=== RUN   TestR1105_ResticIsPinnedOutsideTheOS
    r1105_dockerfile_restic_test.go:81: the Docker apt repo codename is hard-coded — it must come from /etc/os-release (VERSION_CODENAME)
    r1105_dockerfile_restic_test.go:84: the Docker apt repo line does not read VERSION_CODENAME
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/cmd/controller	0.008s
FAIL
### mutation: the pinned-sum check removed
=== RUN   TestR1105_ResticIsPinnedOutsideTheOS
    r1105_dockerfile_restic_test.go:58: the restic stage no longer does "echo \"${want}  ${f}\" | sha256sum -c -"
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/cmd/controller	0.009s
FAIL
### mutation: runtime base not pinned by digest
=== RUN   TestR1105_ResticIsPinnedOutsideTheOS
    r1105_dockerfile_restic_test.go:77: base image debian:13.7-slim is not pinned by digest
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/cmd/controller	0.010s
FAIL
### unmutated
=== RUN   TestR1105_ResticIsPinnedOutsideTheOS
--- PASS: TestR1105_ResticIsPinnedOutsideTheOS (0.00s)
ok  	gitea.dooplex.hu/admin/felhom-controller/cmd/controller	0.009s