chore(infra): pin the Claude Code CLI and nginx, move the runner off EOL node

CLAUDE.md

@@ -108,6 +108,9 @@ Key additions for production: `ENVIRONMENT=production`, `ADMIN_PASSWORD`, `CORS_
 
 ## Gotchas
 
+- **Bumping the Claude Code CLI is a deliberate act**: `CLAUDE_CODE_VERSION` is pinned in `infra/docker/claude-runner/Dockerfile`. The SSE pipeline parses that CLI's stream-json output, so an upstream format change breaks production at image-rebuild time with no code change and no CI signal. To bump: raise the ARG, rebuild, run a session end to end, and check the five event types still arrive.
+
+
 - **CI coverage threshold**: `--cov-fail-under=70` (current coverage ~75%). Raising to 80% requires covering `admin/views.py`, `main.py` lifespan, and more router branches.
 - **Lost stats tests**: `tests/modules/identity/test_stats.py` (176 lines covering the user stats endpoint) was dropped in the #42 squash; it survives on local branch `feat/dashboard-activity-chart-impl` (62bf88e) — cherry-pick and adapt to boost coverage.
 - **Entrypoint parallel I/O**: clone, metadata (`gh pr view --json`), and diff (`gh pr diff`) run as background jobs with `wait`. The `-R` flag lets `gh` hit the API without a local `.git` dir. `set -e` does NOT propagate from background jobs — each `wait $pid` needs explicit `|| exit 1`. The claude-runner image includes `jq` for parsing the combined metadata JSON.

infra/docker/Dockerfile.web

@@ -19,7 +19,9 @@ COPY . .
 RUN npm run build
 
 # Production stage
-FROM nginx:alpine AS production
+# Pinned to a minor: an unqualified `nginx:alpine` would put a new nginx
+# major into production on the next rebuild with no diff to review.
+FROM nginx:1.29-alpine AS production
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 # NOTE: nginx.conf must be in the build context (apps/web/).

infra/docker/claude-runner/Dockerfile

@@ -1,4 +1,13 @@
-FROM node:20-slim
+# node 20 reached end of life in April 2026, on the one image that executes
+# untrusted PR content. The web build is already on 22.
+FROM node:22-slim
+
+# Pinned deliberately. The whole SSE pipeline parses this CLI's stream-json
+# output -- the five event types in CLAUDE.md are its contract, not ours -- so
+# an upstream format change would break production on the next image rebuild,
+# with no code change and nothing in CI to catch it. Bump this on purpose,
+# then re-run a session end to end.
+ARG CLAUDE_CODE_VERSION=2.1.220
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
@@ -11,7 +20,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
     apt-get update && \
     apt-get install -y --no-install-recommends gh && \
-    npm install -g @anthropic-ai/claude-code && \
+    npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
 RUN useradd -m -s /bin/bash runner