build: bump python from 86f975a to 23c5939 in /docker

[dependabot]

Bumps python from 86f975a to 23c5939.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cdeust]

ZETETIC-REVIEW: REQUEST_CHANGES

Stakes: Low (single-line digest bump, docker/Dockerfile, no runtime logic change).

Digest verification (point 1)

Resolved python:3.14-slim-bookworm live against registry-1.docker.io (OCI index manifest, docker-content-digest header): current tag resolves to sha256:23c59390fc717bf09f9336908199a0ae75d9c4264bf296123f94ad772fea3b52 — exact match to the new digest in this diff, both FROM lines. Python major.minor (3.14) and the Debian variant (bookworm) are unchanged by this bump; only the underlying image content moved. Correct.

Blocking — comment block above the changed line is wrong (§8 source discipline)

Not introduced by this diff, but sitting directly in the same block this PR modifies (docker/Dockerfile:3, :20-23):

• Line 3: # Multi-stage build: Python 3.12 + PostgreSQL 17 + pgvector + Claude Code CLI
• Line 20: # different python:3.12-slim-bookworm.
• Line 23: # source: registry-1.docker.io/v2/library/python/manifests/3.12-slim-bookworm,

The actual pinned tag on both FROM lines is python:3.14-slim-bookworm (confirmed above), not 3.12. The source: comment cites the wrong registry path — a reader following it to re-verify the digest would query the wrong tag. This is exactly the class of defect coding-standards.md §8 exists to prevent (a source citation must point at what it claims to point at). Since this diff's only content is the digest line those comments annotate, fix the three 3.12 → 3.14 references in the same commit.

Blocking — branch is stale against origin/main, both repo gates fail as currently constituted

origin/main is 3 commits ahead of this PR's merge-base (e88e4e21): #331, #419, #427 — the latter two shrank .craftsmanship-baseline.json and re-tightened .claude-plugin/marketplace.json. Ran both gates against the current head of this branch (a7174796):

• python3 scripts/check_craftsmanship.py --base origin/main → exit 1, "baseline entries ADDED without a base-ref match" (7 entries the PR branch's stale baseline carries that main's shrunk baseline no longer has).
• python3 scripts/check_marketplace_pins.py → exit 1, 2 stale pins (hypermnesia-mcp-viz 3.0.0 vs v3.1.0, zetetic-team-subagents 2.36.0 vs v2.37.0) — both already fixed on origin/main.
• Confirmed clean baseline on origin/main itself (exit 0 both gates) — this is not pre-existing repo debt, it is this branch trailing main.

GitHub's green check ran against the PR's stale base, not current origin/main; merging as-is will red-X on the next check_craftsmanship.py --base origin/main / check_marketplace_pins.py run. @dependabot rebase (or a maintainer merge of main) resolves this without any manual edit beyond the comment fix above.

Non-blocking (point 3)

docker/Dockerfile pins the explicit bookworm variant while .devcontainer/Dockerfile and root Dockerfile pin the generic slim tag (currently resolving to the same Debian release, confirmed live). Three genuinely distinct Dockerfiles per the author's framing — correct, no duplicate-consolidation is due — but the tag-naming divergence means docker/Dockerfile is pinned against Debian-version drift and the other two are not; worth an explicit ADR note or aligning all three to the -bookworm suffix if that pin was deliberate.

Required to unblock: (1) fix the three stale 3.12 references in the comment block this PR touches, (2) rebase onto current origin/main so both repo gates pass clean.

[cdeust]

Note for reviewers (non-blocking): this repo pins three separate Dockerfiles to python:3.14, but on two different base-image variants — deliberately, not by drift.

• docker/Dockerfile (this PR) pins python:3.14-slim-bookworm — needs the full Debian bookworm userland for the PostgreSQL 17 + pgvector build toolchain used by the runtime image.
• .devcontainer/Dockerfile (build: bump python from cea0e60 to a7fb1e6 in /.devcontainer #423) and the root Dockerfile (build: bump python from cea0e60 to a7fb1e6 #425) pin python:3.14-slim — the generic slim variant, since neither builds against PostgreSQL from source.

Each Dockerfile is refreshed independently by its own Dependabot docker entry in .github/dependabot.yml, so the two variants' digests move on different schedules. Nothing to reconcile — flagging so a future digest-only diff between these three PRs isn't mistaken for inconsistency.

[cdeust]

ZETETIC-REVIEW: APPROVE

Move 0: no ledger applicable (digest-only Dockerfile pin update); no seen-defect rationalization present.

Verified on head 7ebbaaf (merge-base with origin/main == origin/main HEAD cdf084b — branch is current):

• Diff is exactly the base-image digest pin update for python:3.14-slim-bookworm (builder + runtime stages), Python major/minor unchanged (3.14 → 3.14, only the digest moves).
• Digest sha256:23c59390... independently reconfirmed against registry-1.docker.io/v2/library/python/manifests/3.14-slim-bookworm in a prior verification pass — matches the tag.
• Source comment previously flagged as citing a wrong Python version (3.12) is now corrected: both the prose comment and the source: line consistently say 3.14-slim-bookworm, with an updated fetch date (2026-08-10). No stale-comment defect remains.
• scripts/check_craftsmanship.py --base origin/main: OK (exit 0).
• scripts/check_marketplace_pins.py: all pins current (same pre-existing unrelated NOTICE as the other three PRs).

Mergeable as-is.