Remaining supply-chain/hardening from ROADMAP: run images as non-root (+ document --user); multi-arch via TARGETARCH (arm64); pip --require-hashes (hash every transitive dep); GPG-verify shellcheck/PMD instead of pin-on-known-good; refresh note for the rolling dotnet-install.sh hash.
Remaining supply-chain/hardening from ROADMAP: run images as non-root (+ document
--user); multi-arch via TARGETARCH (arm64); pip--require-hashes(hash every transitive dep); GPG-verify shellcheck/PMD instead of pin-on-known-good; refresh note for the rolling dotnet-install.sh hash.