gh-aw-node contains vulnerable packages and released component pins need refresh

## Summary

A final-image scan of the artifacts selected by gh-aw v0.82.14 found:

1. Vulnerable packages in the gh-aw-owned `gh-aw-node` image.
2. Component pins referencing releases with findings tracked in their owning repositories.

This issue tracks the gh-aw-owned image and the integration work needed after clean component releases become available. It does not duplicate remediation ownership from the component repositories.

An independent follow-up scan also confirmed that gh-aw-mcpg v0.4.3, currently selected on main, remains affected. Updating from v0.4.1 to v0.4.3 alone does not resolve the MCP gateway findings.

## gh-aw-owned finding

### gh-aw-node

Affected image:

```text
ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b
```

| Package | Installed version | Reported fixed version | Finding |
| --- | --- | --- | --- |
| libcrypto3 / libssl3 | `3.5.6-r0` | `3.5.7+` | Multiple OpenSSL advisories |
| musl | `1.2.6-r2` | To be confirmed for this image | CVE-2026-40200 |
| tar | `7.5.13` | `7.5.19+` | Package advisory |
| brace-expansion | `5.0.5` | `5.0.7+` | Package advisory |
| sigstore | `4.1.0` | `4.1.1+` | Package advisory |
| undici | `6.25.0` | `6.27.0+` | Package advisory |

The safe-output MCP runtime primarily executes Node, local JavaScript, and git, so some npm-network findings may not be reachable in normal operation. The affected packages nevertheless remain present in the published image.

Verification should record the exact advisory ID, scanner severity, package path, and runtime applicability for every finding. In particular, the gh-aw-node Alpine release must be checked before treating musl `1.2.6-r2` as vulnerable: Alpine 3.24 records that revision as fixed for CVE-2026-40200.

## Related component findings

- Agent and API-proxy images: [github/gh-aw-firewall#6504](https://github.com/github/gh-aw-firewall/issues/6504)
- Squid image license inventory: [github/gh-aw-firewall#6506](https://github.com/github/gh-aw-firewall/issues/6506)
- MCP gateway image: [github/gh-aw-mcpg#9836](https://github.com/github/gh-aw-mcpg/issues/9836)
- GitHub MCP server fixes: [github/github-mcp-server#2927](https://github.com/github/github-mcp-server/issues/2927)

The Squid issue concerns license inventory rather than vulnerable packages. It is listed here only as a gh-aw-firewall release-readiness dependency, not as CVE remediation. The GitHub MCP server fixes are merged, but a patch release containing them is still pending.

### Verified gh-aw-mcpg v0.4.3 status

The July 22, 2026 follow-up scan covered both immutable platform images:

```text
Index: sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83
linux/amd64: sha256:a257bf876a4ce12745a84427c1ff4aedd029ccc4547bc1d11a6f313eb1ab777a
linux/arm64: sha256:3774c57e8aacc2c6dcc65fee605c5a2e66d405c010916533c1fef18f52c12d93
```

Both platforms produced the same results:

- GO-2026-4970, GO-2026-5037, and GO-2026-5038 originate from `/usr/bin/docker`, not `awmg`.
- Alpine 3.24.1 musl `1.2.6-r2` is fixed for CVE-2026-40200, so that original finding does not apply to v0.4.3.
- Additional current matches affect Docker CLI, `awmg` dependencies, and BusyBox. Full attribution is recorded in [github/gh-aw-mcpg#9836](https://github.com/github/gh-aw-mcpg/issues/9836).

## Released pins

gh-aw v0.82.14 selects:

- gh-aw-firewall v0.27.37
- gh-aw-mcpg v0.4.1
- github-mcp-server v1.6.0
- gh-aw-node digest `529d02eb...`

Current main selects gh-aw-mcpg v0.4.3, but that update is not present in v0.82.14 and v0.4.3 is independently verified as still affected.

For this investigation, the baseline is v0.82.14 and the supported target is the latest non-prerelease gh-aw release available when remediation is published. Final-image verification should cover both `linux/amd64` and `linux/arm64`.

## Work that can proceed immediately

- [ ] Resolve and record the immutable platform digests for the current `gh-aw-node` image.
- [ ] Generate a final-image SBOM and vulnerability report for each supported platform.
- [ ] Record every finding's advisory ID, severity, installed version, fixed version, package path, and runtime applicability.
- [ ] Confirm whether CVE-2026-40200 applies to the gh-aw-node image's Alpine package.
- [ ] Refresh the `gh-aw-node` base/runtime packages and npm dependencies as needed.
- [ ] Publish and verify an immutable `gh-aw-node` digest whose remaining findings have documented applicability.

## Release-blocked integration work

- [ ] Update gh-aw-firewall after releases addressing [#6504](https://github.com/github/gh-aw-firewall/issues/6504) and the release-readiness work in [#6506](https://github.com/github/gh-aw-firewall/issues/6506).
- [ ] Update gh-aw-mcpg to a release newer than v0.4.3 that addresses or documents the findings in [github/gh-aw-mcpg#9836](https://github.com/github/gh-aw-mcpg/issues/9836).
- [ ] Update github-mcp-server after a patch release containing [github/github-mcp-server#2927](https://github.com/github/github-mcp-server/issues/2927).
- [ ] Publish a gh-aw release with the reviewed component pins and immutable `gh-aw-node` digest.
- [ ] Verify the final selected artifacts for both supported platforms.

## Reproduction context

The gh-aw-node findings were observed using:

- Syft v1.46.0
- Grype v0.115.0

```bash
IMAGE='ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b'

syft --platform linux/amd64 "$IMAGE" -o syft-json=sbom.json
grype sbom:sbom.json
```

The image is multi-architecture, so package inventories may differ by platform.

## Completion criteria

A supported gh-aw release references reviewed component releases and an immutable `gh-aw-node` digest whose remaining findings have documented applicability.

Start with the gh-aw-node image digest and the Syft v1.46.0 and Grype v0.115.0 commands in the issue, running them for both linux/amd64 and linux/arm64. Review the gh-aw-firewall, gh-aw-mcpg, and github-mcp-server release dependencies before updating the selected pins. Done means a supported gh-aw release references reviewed component releases and an immutable gh-aw-node digest with remaining findings documented.

Written by the indexing model from the issue text.