fix(docker): bump runtime bases to patched digests for Trivy gate (#271)

The Docker/Trivy CRITICAL/HIGH gate has been failing since 08-30 on all
three hawk images (CVE-2026-56408, -66046, -76641 in expat < 2.8.3-2).
The failing RUN apk/apt layers are cached via cache-from: type=gha, so
re-running with the same base digest restores the vulnerable layer.

- Dockerfile + Dockerfile.daemon: alpine:3.23.5@fd791d74 -> alpine:3.24@28bd5fe8 (libexpat 2.8.4-r0)
- internal/sandbox/sandbox.Dockerfile: node:22-bookworm-slim@d649c27d -> @4d676821 (libexpat 2.8.3-2+)

Each new digest invalidates the GHA cache so the package layer rebuilds
with patched expat. Verified locally: the CI trivy command exits 0 on
the rebuilt amd64+arm64 hawk images and the sandbox image.

Author: Patel230

Dockerfile

@@ -49,7 +49,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     -o hawk ./cmd/hawk
 
 # Runtime stage — Alpine (hawk requires git + bash for workspace operations; distroless excluded)
-FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache ca-certificates git bash tini && \

Dockerfile.daemon

@@ -31,7 +31,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
       -X main.BuildDate=${BUILD_DATE}" \
     -o hawk ./cmd/hawk
 
-FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache ca-certificates git bash curl tini && \

internal/sandbox/sandbox.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
+FROM node:22-bookworm-slim@sha256:4d676821dff059fd00d277ee4261ef34ea712317fed0737c03941481b5760c96
 
 RUN npm install --global npm@12.0.2 && \
     npm cache clean --force && \