Digest-pin both bases and teach Dependabot to bump them

[qcentic-dev]

Part of #23. Spec: ADR 0016 — The 0.1.0 shape, clauses D5, D10, D20, D26.

Phase 2 — Images and container
Blocked by: #37, #43
Blocks: nothing

What

Both images are digest-pinned, and neither registry makes that easy in the same way:

• ubuntu:24.04 is a rolling tag; Docker Hub retains digests indefinitely, so the digest is a real pin and Dependabot's docker ecosystem handles it.
• gcr.io/distroless/nodejs24 has no semver tags at all — four mutable names plus opaque build SHAs. Whatever automation lands has to update a digest pin for a registry with no version to compare against, or the image silently drifts its Node patch version between builds.

Also record that gcr.io is a third registry in the build path (D26): #6 settles Docker Hub primary / GHCR mirror for publishing, but pulling the base from Google's registry is a separate availability and rate-limit dependency on every single build.

Done when

• .github/dependabot.yml covers both Dockerfiles and actually opens a PR when either base digest moves — demonstrated, not configured-and-hoped
• NODE_VERSION in deploy/core.Dockerfile is bumped by the same flow (it is what clears the Node-attributed findings, including the only CRITICAL and all four HIGH)
• The gcr.io build-path dependency is written into docs/contribute/ci-cd.md

---

_{Decisions are locked in ADR 0016. If this ticket needs one changed, amend the ADR in the same PR — do not decide it in a comment.}