GHSA-6q48-6c7w-9gw2: the older bundle still trusts emSign intermediates
whose keys were compromised (Trivy critical, 2026-10-23 sweep). The
no-cache release build also picks up the base image's Debian fixes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01AmGMkB5pQHziini41J7rbQ