Weekly image builds silently failing — no image published since Feb 4, known vulns unpatched

[heskew]

What's happening

docker.yml's weekly scheduled run (Mondays 9am UTC) has failed every week for months — no successful scheduled run in recent history, and the newest ghcr image version is 2026-02-04 (c1ddb7c). The failure is the security gates doing their job with nobody watching:

• security-scan-rust: cargo audit finds 7 vulnerabilities, all transitive, all patch-fixable:
  • quinn-proto: RUSTSEC-2026-0037 (DoS, fix ≥0.11.14), RUSTSEC-2026-0185 (memory exhaustion, fix ≥0.11.15)
  • rustls-webpki: RUSTSEC-2026-0104, -0049, -0098, -0099 (CRL/name-constraint bugs, fix ≥0.103.13)
  • time: RUSTSEC-2026-0009 (stack exhaustion DoS, fix ≥0.3.47)
• security-scan-node: npm audit --audit-level=high also failing (findings TBD)

Because build-image needs both scans, no image publishes — so the image users pull (see #1) still carries the vulnerable versions.

Fix

1. cargo update the three crates past the advisory thresholds; address npm audit findings in ui/
2. Verify full test suite still green
3. Longer term: Dependabot (added in CI: overhaul GitHub workflows — Rust test gate, working trivyignore audit, supply-chain hygiene #5/PR CI overhaul + issue #1 devexp fixes #6) turns these into PRs instead of silent Monday failures