build: bump python from 23c5939 to 416f0db in /docker

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps python from 23c5939 to 416f0db.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cdeust]

ZETETIC-REVIEW: APPROVE

Verified 2026-09-02:

• The diff moves the python:3.14-slim-bookworm digest in both stages of docker/Dockerfile (builder + runtime) to the same new digest 416f0db2…; a digest pin is content-addressed, so what CI built is exactly that image, and a pull by digest from docker.io/library/python can only succeed for a blob that repository actually holds.
• CI on the head commit: Docker Smoke (bare-container DB-less contract) built and ran the image from this digest and passed, along with every other required check (gh pr checks 450); mergeable state CLEAN.
• Docker Hub's 3.14-slim-bookworm tag has since advanced again (current top-level digest 9ab8d9c8… on 2026-09-02), which is expected for a moving tag and is Dependabot's next PR, not a defect of this one.
  Merge.