fix(images): refresh runner and distro security floors

CONTRIBUTING.md

@@ -26,15 +26,15 @@ technical problem on its own terms and the private tracker links to it.
 
 ## Set up the repository
 
-The monorepo recommends Node.js 24 LTS and uses pnpm 11.20.0. Node.js 22 is
+The monorepo recommends Node.js 24 LTS and uses pnpm 11.28.2. Node.js 22 is
 also supported from 22.13.0. Docker is required for the local platform stack
 and workspace end-to-end tests. For nvm users, the repository's `.nvmrc` selects
 the recommended Node.js 24 line with `nvm use`.
 
 ```bash
 git clone https://github.com/theam/facility.git
 cd facility
-corepack install --global pnpm@11.20.0
+corepack install --global pnpm@11.28.2
 pnpm dev
 ```
 

Dockerfile

@@ -8,7 +8,7 @@ ENV PNPM_HOME=/pnpm
 ENV PATH=/pnpm:$PATH
 # Keep a digest-pinned base while still making a reviewed Debian security
 # refresh invalidate BuildKit's cached package layer.
-ARG DEBIAN_SECURITY_REFRESH=20260915
+ARG DEBIAN_SECURITY_REFRESH=20261005
 # The slim base has Node's bundled trust roots but not the system CA package.
 # Bootstrap HTTPS with those roots; apt then installs the maintained OS bundle.
 RUN node -e "const fs = require('node:fs'); fs.mkdirSync('/etc/ssl/certs', {recursive:true}); fs.writeFileSync('/etc/ssl/certs/ca-certificates.crt', require('node:tls').rootCertificates.join('\\n'))" \

README.md

@@ -62,7 +62,7 @@ The project manifest also lets you [choose CPU and memory for new story workspac
 
 ## Quick start: run Facility
 
-You need Docker, Node.js 24 LTS, and pnpm 11.20.0. Node.js 22 is also supported
+You need Docker, Node.js 24 LTS, and pnpm 11.28.2. Node.js 22 is also supported
 from 22.13.0. Start the application locally, then connect a repository to run
 Claude Code or Codex in a story workspace.
 
@@ -71,7 +71,7 @@ Claude Code or Codex in a story workspace.
 ```bash
 git clone https://github.com/theam/facility.git
 cd facility
-corepack install --global pnpm@11.20.0
+corepack install --global pnpm@11.28.2
 pnpm dev
 ```
 
@@ -161,7 +161,7 @@ behavior and boundaries can be agreed on.
 ```bash
 git clone https://github.com/theam/facility.git
 cd facility
-corepack install --global pnpm@11.20.0
+corepack install --global pnpm@11.28.2
 pnpm install --frozen-lockfile
 pnpm verify
 ```

apps/docs/docs/reference/reference-fixture.md

@@ -12,7 +12,7 @@ sample builder and scheduled-security agents. It has no network or credential de
 From a clean checkout, run:
 
 ```bash
-corepack install --global pnpm@11.20.0
+corepack install --global pnpm@11.28.2
 pnpm install --frozen-lockfile
 docker build -f runner/Dockerfile -t facility-runner:dev .
 FACILITY_E2E_DOCKER=1 \

apps/docs/docs/self-host/local-development.md

@@ -9,10 +9,10 @@ This guide covers work on the Facility monorepo. If you only want to run the pro
 
 ## Toolchain
 
-Install Node.js 24 LTS and pnpm 11.20.0 before running the repository:
+Install Node.js 24 LTS and pnpm 11.28.2 before running the repository:
 
 ```bash
-corepack install --global pnpm@11.20.0
+corepack install --global pnpm@11.28.2
 ```
 
 The root `package.json` also accepts Node.js 22 from 22.13.0. Use the repository `.nvmrc` when

apps/docs/docs/self-host/quickstart.md

@@ -18,7 +18,7 @@ nested Docker images, and persistent volumes.
 ## Start the local stack
 
 ```bash
-corepack install --global pnpm@11.20.0
+corepack install --global pnpm@11.28.2
 pnpm install --frozen-lockfile
 cp .env.example .env
 docker build -f runner/Dockerfile -t facility-runner:dev .

apps/web/Dockerfile

@@ -3,7 +3,7 @@
 #   docker build -f apps/web/Dockerfile -t facility/web .
 FROM node:24-trixie-slim@sha256:50c3b2f6988dfc307b86e5301d69611af31f4789bdf232863b07d3b02fe55ae0 AS base
 ENV PNPM_HOME=/pnpm PATH=/pnpm:$PATH
-ARG DEBIAN_SECURITY_REFRESH=20260915
+ARG DEBIAN_SECURITY_REFRESH=20261005
 RUN test -n "$DEBIAN_SECURITY_REFRESH" \
   && apt-get update \
   && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \

package.json

@@ -9,7 +9,7 @@
   "engines": {
     "node": "^22.13.0 || ^24.0.0"
   },
-  "packageManager": "pnpm@11.20.0",
+  "packageManager": "pnpm@11.28.2",
   "scripts": {
     "build": "turbo run build",
     "clean:outputs": "node scripts/clean-outputs.mjs",

patches/js-yaml@3.15.2.patch

@@ -0,0 +1,21 @@
+diff --git a/bin/js-yaml.js b/bin/js-yaml.js
+index e79186be6f56f1d92de9bcd4fa4b10fff9564795..e1c0a90287763ec0bb06117c14bff8d5cb0e9e99 100755
+--- a/bin/js-yaml.js
++++ b/bin/js-yaml.js
+@@ -23,10 +23,15 @@ var yaml = require('..');
+
+ var cli = new argparse.ArgumentParser({
+   prog:     'js-yaml',
+-  version:  require('../package.json').version,
+   addHelp:  true
+ });
+
++cli.addArgument([ '-v', '--version' ], {
++  action: 'version',
++  version: require('../package.json').version,
++  help: "show program's version number and exit"
++});
++
+
+ cli.addArgument([ '-c', '--compact' ], {
+   help:   'Display errors in compact mode',