[antoinetoussaint-byte]

The corrected migrate source build removed dependency findings, but all ten scanned consumer migration images still used the embedded Alpine 3.21.8 base. Trivy 0.76.1 reported 23 fixable OS findings per image, including HIGH CVE-2026-84782 in libcrypto3/libssl3. Refreshing the owner bootstrap lock selects Alpine 3.21.9 while retaining the existing PostgreSQL 17 client, migrate source build, module graph and compiler pin.

Classification: fix in service-postgres, which owns the bootstrap base. The existing .github/scripts/update-bootstrap-lock.sh generated the lock after resolving both architectures. No consumer package-upgrade command, server-runtime change, workflow expansion or publication is involved. Docs updated: docs/bootstrap-migrate.md explains OS maintenance, patched versions, exact-source adoption and final-image verification.

The new manifest-list digest is sha256:ee16d92f96db08d9d2d07da48555a27f3a69d8f0759021dbc601195ed0d2b5bd. Independent registry-layer inspection and actual named, auto-removed amd64/arm64 probes installing postgresql17-client=17.11-r0 both confirmed:

Package	Previous	New
libcrypto3 / libssl3	3.3.7-r1	3.3.7-r2
musl / musl-utils	1.2.5-r11	1.2.5-r12
zlib	1.3.2-r0	1.3.2-r1

Validation passed: focused lock/provenance/template/rendered migrate-source tests; go build ./...; go vet ./...; go mod tidy -diff; git diff --check; maintained native codefly agent build --native-only with audit enabled. Both package probes ran psql --version successfully (17.11). The native audit still reports two unpatched upstream Docker advisories GO-2026-4883/4887; this PR changes the emitted bootstrap base, not those host dependencies.

Exact-head hosted CI 40787011513 passed for fa071821a045c47b3497cd3c8a4d38beb26c612c: image job 123162614160 and Go build/vet/tidy job 123167518806. The successful unit phase includes both architecture bootstrap builds and all four database-parity scenarios; emulation was installed before that phase. Migration fail-closed/budget regressions, runtime lifecycle and image scan steps also passed. The ordinary PR path skipped moving the shared runtime tag as designed.

Independent focused source review accepted exact tree 861f331809fd926e920a7d7e4ecc7b33bc13c287, diff SHA256 127b8d070c31642aa5be3ed9df1d874969c8136fb1fb2327d41021dffe9b8cae. The maintained native development build has SHA256 78162af2fe1401fa85b291031a9cea16d4244ca233539143141ad140cf675db2; binary metadata confirms exact head and vcs.modified=false, and its SBOM subject matches. The manifest/cache basename remains 0.0.147 and does not mean published 0.0.147 is corrected. Release publication remains deferred.

Blue rebuilt all ten consumer migration images from this exact-source artifact. Root supplied remote Trivy 0.76.1 results; I read each resulting summary. All ten report Alpine 3.21.9, exit0, zero vulnerabilities and zero secrets at the immutable digests below. This closes the named image package findings for those scanned bytes. Not verified by this PR: consumer rollout/runtime qualification or a new published agent release.

The full local resolver succeeded. An earlier invocation of the unchanged hosted freshness workflow ended with exit255 without identifying the failing command; that failure did not reproduce locally. The resolver also reports upstream migrate4.20.1 as newer; this bounded correction deliberately preserves the independently qualified PostgreSQL/file-only4.19.1 source build from #203.

Root-supplied final consumer scan receipts (registry us-east1-docker.pkg.dev/obin-platform-dev-data/obin-dev-registry):

Image	Scanned digest
annotations/store	sha256:a95a302e055a7a84ef019de3e0aad693c3528ddc08f00be7cb23fb4969e85029
documents/store	sha256:0fa5e11efbacd805d4820cc20bf7d92eb85e916ffdaef9821fd63afb1993254a
documents/vector	sha256:61c4f2ba459e9288852245e9848a0d7869a2bd4227a9cf41d8a33cf70485cc00
evaluation/store	sha256:b253034ad7fd2ba634f8bcca361f9ecc1b41714434cf92fb3376f30be92f20f6
model/store	sha256:1280877e4b7d46b7e324ab0c6fb816548f20b4165028b8511b6f9f7a12c8d3aa
records/store	sha256:91894180d3b7c151c4287b2411aca57aeff95931479e9a28a26f8b2194457ce7
robin/store	sha256:3ccad586a4e8cb30f314d6f7831d3309fb1edf7dd7cc327346bc6712c77d1efd
runtime/store	sha256:33f624206dd662cc84bd67c06e10119622deec4136e927518cdca7fdd85901b9
saas/store	sha256:06f39904096b7575d83ff7df9cf08450d09bd047ca279c236a06958694773cd0
tracing/store	sha256:42e69fe966426cb73ebe686668f38a1d5d676f4f7718661079df21acc0949edc