Changes
- Hummingbird distroless FIPS: Switched container from UBI9 fallback to multi-stage Hummingbird FIPS build (builder + distroless runtime with venv pattern)
- CI fixes: Constitution validation, Gourmand container runner, Trivy scanner — all passing green
- Gourmand clean: 40 violations → 0 (verbose comments, generic names, magic numbers, type ignores, linter config)
- Constitution v1.2.0: Added Section III (Containerfile Conventions), sections renumbered I-IX
Ref: HUM-813 — Hummingbird distroless by design