fix(image): pin musl in the runtime apk transaction so the image builds reproducibly

.claude/skills/runtime-image-relock/SKILL.md

@@ -33,6 +33,16 @@ write a digest CI then rejects.
    postgres patch release, a new pgvector version, a new alpine branch — update
    the `tag` string too. It is descriptive (`postgres-<pg>-pgvector-<ver>-<base>`)
    and a wrong one silently mislabels every release that consumes it.
+   An `apk add` line pins the **whole transaction**, not just the packages
+   you meant to change: `--upgrade` upgrades their dependencies too, and an
+   unnamed one floats with the Alpine index (musl moved the digest that way on
+   2026-10-26 with no Dockerfile change). List what the line would change
+   against the pinned base and name every package it prints:
+
+   ```bash
+   docker run --rm "$(sed -n 's/^ARG POSTGRES_IMAGE=//p' Dockerfile)" sh -c \
+     'apk add --simulate --no-cache --upgrade <the packages on the line>'
+   ```
 2. Push the branch. The `image` job builds the candidate and, on a mismatch,
    fails "Verify runtime image candidate" printing both digests.
 3. Copy the **built** digest into `runtime-image.json` and push again.

Dockerfile

@@ -23,10 +23,14 @@ RUN mkdir /tmp/pgvector /tmp/pgvector-install && \
 FROM ${POSTGRES_IMAGE} AS runtime
 
 RUN rm /usr/local/bin/gosu
+# --upgrade also upgrades each named package's dependencies, so every package
+# this transaction changes is named at its exact version. An unnamed one floats
+# with the Alpine index: musl did on 2026-10-26 and moved the image digest.
 RUN apk add --no-cache --upgrade \
     libcrypto3=3.5.9-r0 \
     libssl3=3.5.9-r0 \
     libuuid=2.42.3-r1 \
+    musl=1.2.6-r3 \
     su-exec=0.3-r0 && \
     ln -s /sbin/su-exec /usr/local/bin/gosu && \
     rm /var/log/apk.log

runtime-image.json

@@ -1,7 +1,7 @@
 {
   "name": "ghcr.io/codefly-dev/service-postgres",
   "tag": "postgres-17.10-pgvector-0.8.5-alpine3.24",
-  "digest": "sha256:202950121004ef53cc303edc8728eda9381d05a7c0dae6faddfd68c139f0b759",
+  "digest": "sha256:1d7680adb926a17a378b4f56e4b33ed98b64c8dabf39f2301b6d5d71ff5c75e3",
   "platforms": [
     "linux/amd64",
     "linux/arm64"

workflow_test.go

@@ -245,6 +245,7 @@ func TestRuntimeDockerfilePinsReproducibleBuildInputs(t *testing.T) {
 	require.Contains(t, dockerfile, "libcrypto3=3.5.9-r0")
 	require.Contains(t, dockerfile, "libssl3=3.5.9-r0")
 	require.Contains(t, dockerfile, "libuuid=2.42.3-r1")
+	require.Contains(t, dockerfile, "musl=1.2.6-r3")
 	require.Contains(t, dockerfile, "su-exec=0.3-r0")
 	require.Contains(t, dockerfile, "RUN rm /usr/local/bin/gosu")
 	require.Contains(t, dockerfile, "ln -s /sbin/su-exec /usr/local/bin/gosu")