fix(container): apt-get upgrade in runtime stage for Debian CVE patches

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **Apply Debian security upgrades on every image build.** The runtime
+  stage's `apt-get install` no longer trusts the base image to be at
+  current patch level — an `apt-get upgrade -y --no-install-recommends`
+  in the same layer pulls security-patched versions of base packages
+  (libcap2, libsystemd0, libudev1, etc.). Closes the gap that caused
+  Trivy's blocking OS-package scan to fail on v1.11.2 after Debian
+  shipped CVE-2026-4878 (libcap2 privilege-escalation TOCTOU race) and
+  CVE-2026-29111 (systemd arbitrary code execution / DoS) without the
+  `debian:bookworm-slim` manifest catching up.
+
 ### Fixed
 
 - **Issue #41:** Makefile's `LANGUAGES` invocation of `yq` now uses `-r`

Dockerfile

@@ -93,23 +93,29 @@ LABEL org.opencontainers.image.description="DevRail developer toolchain containe
 LABEL org.opencontainers.image.licenses="MIT"
 LABEL org.opencontainers.image.version="${DEVRAIL_VERSION}"
 
-# Base system dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    curl \
-    git \
-    gnupg \
-    jq \
-    make \
-    python3 \
-    python3-pip \
-    python3-venv \
-    build-essential \
-    libyaml-dev \
-    shellcheck \
-    unzip \
-    wget \
+# Base system dependencies. `apt-get upgrade` pulls security-patched
+# versions of packages already in the base image (libcap2, libsystemd0,
+# libudev1, etc.) — without it, Trivy's blocking OS-package scan rejects
+# the build when Debian publishes a CVE fix before the base-image
+# manifest catches up. Same layer as `install` to keep image size down.
+RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
+    && apt-get install -y --no-install-recommends \
+        bash \
+        ca-certificates \
+        curl \
+        git \
+        gnupg \
+        jq \
+        make \
+        python3 \
+        python3-pip \
+        python3-venv \
+        build-essential \
+        libyaml-dev \
+        shellcheck \
+        unzip \
+        wget \
     && rm -rf /var/lib/apt/lists/*
 
 # Install yq for YAML parsing in Makefile language detection