[uk-ai-resilience] Untracked Dockerfile SHA-pinning gap: root Dockerfile alpine:3.24 unpinned (alert #940, Tier B)

### Summary

A fresh code-scanning finding (alert [#940](https://github.com/github/gh-aw/security/code-scanning/940), created 2026-09-15, rule `pr-action.rules.dockerfile.image-pinning.dockerfile-non-sha-pinned-image`, `security_severity_level: high`) flags that this repository's own root `Dockerfile` (used to build the gh-aw compiler container) references its base image by tag rather than by an immutable SHA256 digest:

```
FROM alpine:3.24
```

This is distinct from the previously tracked and already-remediated `node:lts-alpine` base used in `actions/setup/js/Dockerfile.safe-outputs-mcp` (covered by existing `[container-image-scan]` issues with a documented daily digest-refresh process) — no existing open issue covers this root `Dockerfile`'s pinning gap.

### Tier: B — Open With Conditions

| Dimension | Rating |
|---|---|
| Exposure amplification | Medium |
| Patchability | High |
| Detectability | High (scanner-flagged, unambiguous rule) |
| Operational fragility | Low |
| Ownership confidence | High |

### Rationale

Images referenced by tag can change without notice, leading to non-deterministic builds and potential unreviewed security regressions in the base layer. This is a low-effort, high-detectability fix: pin to a specific `@sha256:` and add it to the existing container-pin refresh cadence already used for other images in this repo (e.g. `--force-refresh-container-pins`).

### Remediation action

1. Pin `FROM alpine:3.24` to `FROM alpine:3.24@sha256:` in `/Dockerfile`.
2. Wire the pin into the existing automated digest-refresh workflow so it stays current with upstream Alpine security patches.

### SLA urgency: Medium — 30 days

### Reference

Full discussion report: see the "UK AI Open Code Risk & Resilience" weekly discussion report for 2026-09-08 to 2026-09-15 in this repository's Discussions.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/34988746047) · copilot · auto · 87.8 AIC · ⌖ 6.25 AIC · ⊞ 8.2K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Start with /Dockerfile and inspect the existing container-pin refresh workflow invoked by --force-refresh-container-pins; compare how other images are maintained. Pin alpine:3.24 to an immutable digest, include it in that refresh cadence, and confirm the code-scanning finding is resolved.

Written by the indexing model from the issue text.