fix(containers): move tool image to ubi10 for python 3.12

ci-tools moves from UBI9 to UBI10, which is what unblocks pip-audit. No tool version pins change here. !111 (merged) owns those and rebases onto this.

Root cause

pip-audit 2.10.0 raised requires_python to >=3.10. ubi9-minimal's default python3 is 3.9, so pip's Requires-Python filter excludes every 2.10.x candidate and resolves 2.9.0 as the newest installable release.

One cause, two failures. A pinned bump to 2.10.1 cannot install at all, which is why the grouped 12-tool bump in !111 (merged) sits red. An unpinned install, which is what the audit component did at job runtime before the pin landed, resolves a scanner one minor behind and exits 0. Both read to a maintainer as "there is no newer pip-audit", so the floor is invisible at exactly the point where someone would act on it.

Why UBI10

ubi10-minimal ships python3 3.12.13 from ubi-10-baseos and python3-pip 23.3.2 from ubi-10-appstream. That clears the floor and returns the version decision to the ARG pin.

Checked against the UBI10 repository metadata and the CentOS Stream 10 specs before writing anything:

• python3 3.12.13, python3-pip 23.3.2 and python3-pyyaml are all in the UBI10 repository set, along with every other package in the install list.
• RHEL 10 ships no PEP 668 EXTERNALLY-MANAGED marker. Neither the python3.12 nor the python-pip c10s spec creates one, so the system-wide pip3 install of PyYAML and pip-audit works unchanged: no venv, no --break-system-packages.
• Every tag below is the current amd64 10.2 build per the Red Hat container catalog.

A sys.version_info >= (3, 12) assertion runs in the same layer as the package install, so a base image that regresses the interpreter fails this build instead of quietly capping every Python tool downstream.

Two package facts that come with the major

npm is now nodejs-npm (10.9.8, the npm of the default nodejs 22 stream). It is what Provides: npm resolves to, and naming it directly keeps the file describing what we actually install.

RHEL 10 dropped the curl-minimal split at the binary layer. ubi10-minimal carries the full curl 8.12.1 preinstalled, so the standing "do not list curl, it conflicts" note describes a package that no longer exists. The comment is corrected; the install list is unchanged.

What moved, what stayed

File	Change	Basis
containers/ci-tools.Containerfile	ubi10/ubi-minimal:10.2-1786398535	The fix. python 3.12.
containers/ci-buildah.Containerfile	ubi10/ubi:10.2-1786398253	buildah 1.43.x, podman 5.8.x and skopeo 1.22.x are all in ubi-10-appstream. podman's rootless networking dependency resolves to pasta, which dnf picks up from podman's own requires.
.gitlab/ci/sim/sim-buildkit.Containerfile	ubi10/ubi-micro:10.2-1786324819	Fixture carrying a LABEL and CMD ["/bin/true"].
validate:templates:syntax, validate:templates:shape	ubi10/ubi-minimal:10.2-1786398535	python3-pyyaml and python3-pip are both on 10. This also retires the 3.9 ceiling that broke both jobs on 2026-08-04.
containers/ci-buildkit.Containerfile	stays on ubi9, comment only	UBI10 carries neither iptables nor slirp4netns. RHEL 10 replaced the iptables front end with nftables and slirp4netns with pasta, and both are the rootless networking stack buildkitd --rootless runs on. Moving that image is a networking change and wants the rootless sim as evidence. The sim is red today for an unrelated reason (rootlesskit refuses to run as root on the SaaS Docker executor), so there is no baseline to compare a swapped stack against.

containers/ci-latex.Containerfile is Fedora-based and untouched, prose included: editing it pulls a TeX Live full build into validate:containers for the sake of a comment.

Verification

validate:containers is the evidence, and the changed set gives it the right coverage. ci-tools changed, so the job builds ci-tools first, then ci-go, ci-go-fips, ci-rust and ci-kaniko against the fresh base, plus ci-buildah and ci-buildkit. ci-rust's own microdnf list (gcc, gcc-c++, make, openssl-devel, pkg-config, xz) resolves on UBI10, with pkg-config coming from pkgconf-pkg-config.

After this

The shared Renovate preset needs no change. Its UBI rule already matches registry.access.redhat.com/ubi{9,10}{/,}**, and no custom manager hardcodes a UBI major.

Renovate rebases !111 (merged) on its next daily run, and pip-audit 2.10.1 resolves normally on 3.12.