[afoote-mitre]

Summary

Pin the Node dependency-build and Distroless runtime images so rebuilding an unchanged commit cannot silently select a different base image. Document the deliberate refresh process required to receive future security updates.

Changes and Rationale

Change	Primary files	Why it is needed
Pin builder and runtime images to multi-platform SHA-256 manifest digests	Dockerfile, Dockerfile.local	Mutable tags can produce different image contents from identical source. Digest pins make base-image selection reproducible while retaining architecture selection, nonroot execution, and runtime-only dependencies. The default AWS build remains free of secret-mount syntax; the local build retains its npm CA secret.
Require digest pins in the existing packaging assertions	config/runtime-config.test.js	Detect accidental removal of image pins while preserving the existing runtime hardening checks.
Document how to refresh both Dockerfiles and interpret scan results	README.md	Digest pins do not automatically receive patches. Maintainers need to update the pins deliberately, rebuild, and assess native packages against vendor advisories.

[afoote-mitre]

Superseded by #193, which pins verified Node.js 24.22.1 builder/runtime images, aligns CI, adds synchronized-input assertions, and updates refresh guidance. This draft's sole unique image-pinning commit is covered by the replacement PR; the earlier dependency-removal changes are already on dev.