[damccorm]

Follows up on #40696 to pick up the remaining CA trust bundle updates:

• Bumps certifi to 2026.10.23 and grpcio / grpcio-status to 1.85.0 across Python and ML container requirement files.
• Updates Go, Java distroless, and Python distroless container base images from gcr.io/distroless/*-debian12 to *-debian13, since GoogleContainerTools/distroless discontinued debian12 builds and only publishes current Debian ca-certificates security updates (DSA-6572-1) to debian13.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.42%. Comparing base (2213e54) to head (852bf53).
⚠️ Report is 21 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #40811       +/-   ##
===========================================
+ Coverage        0   56.42%   +56.42%     
===========================================
  Files           0      875      +875     
  Lines           0   154689   +154689     
===========================================
+ Hits            0    87285    +87285     
- Misses          0    65545    +65545     
- Partials        0     1859     +1859     

Flag	Coverage Δ
go	28.91% <ø> (?)
python	79.90% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment assign set of reviewers

[damccorm]

assign set of reviewers

[github-actions]

Assigning reviewers:

R: @Abacn for label java.
Backup reviewer: kennknowles (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).