Move the app runtime to distroless Debian 13 and scan its base before merge

Removes the release blocker for incident 304cc0cbdc423fcf without touching the verified application.

• Dockerfile.app: the runtime stage becomes FROM gcr.io/distroless/static-debian13:nonroot. The Debian 12 LTS advisories that denied Package (DLA-4845-1, DLA-4792-1, DLA-4854-1 in ca-certificates and tzdata) do not apply to it. Unlike scratch, it keeps /tmp, which ParseMultipartForm(1024) needs for uploads over 1 KiB, and /etc/passwd and nsswitch.conf. Only the FROM line and a comment change.
• base_image_scan: a new test-stage job runs the Package image gate on the runtime base image in every MR pipeline. A base-image advisory now blocks the MR, not a merged repair.
• Trivy cache: Package and base_image_scan reuse a cached vulnerability DB.

Release path: !2 (merged) is merged and the controller is deployed from it (aegisflow-control-00009). It recorded Package · blocked on #3 (closed) and classified it as a base-image block. When this merges, the protected pipeline's Package job asks the controller for release authorization. The controller adopts this commit only if:

• the application inputs are byte-identical to the verified repair 2d8c06c;
• Dockerfile.app changes only allowlisted FROM images;
• every required job plus base_image_scan passed.

Canary and supervised approval then run again for the new SHA.

This is an operator-authored remediation, not a Duo change; the repair itself remains Duo's MR !1 (merged).

🤖 Generated with Claude Code