fix(deps): update DOMPurify and runtime image packages

[alangou]

Summary

Refresh runtime image packages and the Mermaid linter's DOMPurify dependency. The supervisor previously installed firewall tools without upgrading OpenSSL already present in Alpine; rebuilt images now pick up distro package updates. No application code changes.

Related Issue

Maintenance of upstream dependencies using published fixes. No new vulnerability is disclosed and no public security issue was filed, following SECURITY.md.

Changes

• Refresh the multi-architecture distroless/cc-debian13:nonroot digest. Both amd64 and arm64 include libssl3t64 3.5.7-1~deb13u2.
• Run apk upgrade --no-cache before installing supervisor firewall tools, retaining Alpine 3.22. The rebuilt amd64 image includes libssl3 and libcrypto3 at 3.5.8-r0.
• Pin DOMPurify to 3.4.15 and update only its npm lockfile entry.
• Document the image rebuild boundary in the architecture overview and image diagnostics skill.

Testing

• mise run pre-commit passed on a clean checkout of the pushed commit.
• mise run ci passed on the same commit, including Go SDK CI, Rust dependency policy checks, lint/type checks, and unit/integration tests.
• Existing Rust unit/integration tests, 238 Python tests, 105 TypeScript tests, and auxiliary test tasks passed. Local Rust tests required /usr/sbin on PATH and a short tmpfs temporary path for filesystem/socket tests.
• mise run e2e:docker: passed CLI conformance and 120 Rust E2E tests with the rebuilt supervisor.
• Mermaid validation: 183 files passed; both hook-removal regression variants passed against DOMPurify 3.4.15. Markdown and SPDX checks passed.
• Built both amd64 images with OPENSHELL_AUDITABLE=1; verified startup and embedded .dep-v0 metadata. Trivy 0.74.0 detected 503 Rust packages in the gateway and 386 in the supervisor, with no Rust findings and no High/Critical findings in either image.
• Trivy found no supervisor vulnerabilities. Gateway OS findings remain: 13 Medium, seven Low, and one Unknown, including zlib CVE-2026-85091 at Medium with no fixed version reported. This PR does not claim to resolve every scanner finding.
• ARM64 base/package versions were inspected; ARM64 runtime execution was not tested.

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Architecture documentation and related diagnostic skill updated
• Existing unit and E2E coverage exercised; no application/test code changes

[github-actions]

Label test:e2e applied for 7ee7217. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.