Upgrade github.com/docker/docker module to v29.x (CVE-2026-34040)

Context

The weekly CVE Audit (scheduled pipeline, cve-trivy-image job) reports HIGH CVE-2026-34040 in github.com/docker/docker v28.5.2+incompatible, fixed in 29.3.1. Present in every run since 2026-05-18 (e.g. pipeline 2566049692, 2026-06-01).

The remediation is a major-version module upgrade (v28 → v29), which changes Docker Engine API client interfaces used by the engine — it needs a dedicated change with regression testing rather than a routine dependency bump (the 2026-05-29 bump cycle, !1157 (merged), intentionally did not include it).

Related findings in the same module, currently upstream-blocked (no fixed version published): CVE-2026-41567, CVE-2026-42306 — expected to clear or become actionable with the same upgrade.

To do

  • Bump github.com/docker/docker to ≥ 29.3.1 in engine/go.mod (align docker/cli and other docker/* modules to the same major)
  • Fix compilation breakages from the v28 → v29 API changes (client interfaces, types)
  • Check DOCKER_API_VERSION / minimum-API assumptions against the new client (dle-packaged pins API 1.41 for docker-ce 29.4.3 — keep engine consistent)
  • Run the full engine test suite + integration tests against a supported Docker Engine version
  • Manual smoke test: clone create/destroy, snapshot, container lifecycle through the upgraded client
  • Merge via standard MR review; note this issue number in the MR

Acceptance criteria

  • go.mod resolves github.com/docker/docker ≥ 29.3.1; no +incompatible v28 references remain in go.sum for this module
  • CI is green on the MR (unit + integration), and cve-govulncheck reports no called advisories introduced by the upgrade
  • The first weekly CVE Audit run after merge no longer reports CVE-2026-34040 (link that pipeline here as closure evidence)
  • CVE-2026-41567 / CVE-2026-42306 status re-checked in the same run: cleared, or still upstream-blocked and re-documented
  • No regression in clone/snapshot operations on the smoke test

Target: 2026-Q3