v0.36.1: the runtime image drops its installer

The runtime image stops shipping its own installer. The runtime stage uninstalls setuptools, wheel and pip once the hash-pinned install is done, and the python:3.13-slim base digest held back on 2026-08-17 is taken. Both HIGH findings behind that hold live in one place, pip's vendored tree, so removing the installer removes their single source and the container no longer carries a package manager it never used. Measured rather than assumed: pip 26.1.2 and 26.2.1 vendor identical copies of the flagged packages, so that code was in the shipped image all along and only its detectability changed. Proven against the real gate before shipping: a preflight of the curated tree built the image and scanned it, and the Trivy analysis came back with zero results. No Python source change; the published wheel is unaffected. Full detail in CHANGELOG.md.