Release v1.9.1

What changed

• Added a dedicated non-blocking Docker hardening workflow in CI:
• Dockerfile lint (hadolint)
• runtime image size sanity reporting
• Trivy vulnerability scan (HIGH/CRITICAL)
• Hardened Docker reproducibility by pinning the Python base image with digest in Dockerfile.
• Improved container safety with a fixed non-root runtime user (UID 10001) and safer pip defaults.
• Updated Docker documentation with local hardening commands and reproducibility guidance.

Why it matters

• Improves supply-chain and build reproducibility for contributors and CI.
• Adds visible Docker security checks without blocking delivery workflows.
• Strengthens dev/CI container hygiene while preserving existing product behavior.

Notes

• v1.9.1 is a patch hardening release.
• No CLI/runtime behavior changes.
• No API or output schema/contract changes.

GitHub Pull Requests Included

• Feature/v1.9.1 docker hardening by @damienSavoldelli in #48
• release: prepare v1.9.1 by @damienSavoldelli in #49

Full Changelog: v1.9.0...v1.9.1