fix(bridge): use Azure Linux distroless shipping runtimes

[Pal Lakatos-Toth (pallakatos)]

Summary

Correct the imported Bridge shipping images to follow Kars core's Microsoft Azure Linux 3 distroless runtime policy. The previous BFF native lane used a separate distroless test image while the shipping BFF remained Debian, and source/config scanning did not qualify the final application images.

• BFF now ships on core's Azure Linux distroless base; native acceptance builds the actual shipping Dockerfile.
• Web and Teams retain Node 22, application locks and native sharp support. Only the official Node executable/license is copied from the Node build stage. Microsoft libstdc++ comes from its verified complete RPM-owned payload, with original package inventories preserved and extended.
• Shipping images contain no shell, package manager or global npm tree. Actual final-image distribution, numeric UID/GID, CA trust, read-only startup, web sharp and both gateway listeners are checked.
• Existing required component jobs scan the actual BFF/web/gateway images, failing on HIGH/CRITICAL findings including unfixed findings and retaining JSON evidence.
• Document the actual Helm 4 fresh Namespace ownership conflict and create-only bootstrap; do not adopt existing namespaces.

Qualification

• 16 Node packaging contracts and 8 image-contract/orchestration tests passed locally.
• Existing source audit, LOC, copyright, crypto and no-stubs gates passed.
• Workflow YAML and the documented namespace render/metadata flow checked offline.
• Real digest-verified Microsoft base filesystem/CA checks passed. The Node implementation owner inspected native library/version closure; this is not runtime execution.
• Two bounded independent AI review contexts reported no significant source issues. The new audit transparently cites the maintainer's existing delegated-review authority.

The first public head, a8d4585c842e5a7e584c3c9b0c8295ece777eba1, subsequently passed:

• Actual BFF and web shipping-image builds, runtime contracts and HIGH/CRITICAL scans, including unfixed findings: zero findings. Web native sharp execution passed.
• Native qualification: 18/18 runtime cases plus all three cold API/admission lanes; active-SRE combined qualification is not claimed.
• Complete core CI, including E2E and benchmark regression.

The component workflow nevertheless failed its old packaging assertion requiring literal USER 10001. Current head 10943389e5b74b22b129b782838ca7377125d774 corrects that test to require the intended USER 10001:10001, explicit Microsoft distroless base and no runtime shell instructions, and records the outcome. All shipping/production bytes remain unchanged. The prior failed result remains failed; the gateway image steps were not reached.

Fresh current-head qualification, including actual execution of the corrected test and gateway image checks, remains required. This draft is not merge, release or deployment approval.

Preserved limits

No main changes, cluster mutations, controller-template changes, new credential authority, Node-major upgrade, dependency-lock changes or security-gate waivers. Earlier failed image scans remain failed. Optional witness image remediation and full qualified-root migration (#567) are separate; neither is claimed complete here.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None