HH-443: establish production CI and supply-chain evidence (#93)

* ci: enforce production release gates

* ci: close release gate review blockers

* ci: preserve verified digests during promotion

* ci: serialize and verify release cleanup

* ci: build govulncheck with Shangwutong toolchain

---------

Co-authored-by: Rogee <rogee@ipao.vip>

deploy/docker/Dockerfile

@@ -2,7 +2,10 @@
 # Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices
 
 # ========== Frontend Build Stage ==========
-FROM node:22-alpine AS frontend-builder
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS frontend-builder
+
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 
 WORKDIR /app
 
@@ -14,18 +17,17 @@ COPY frontend/ frontend/
 RUN pnpm --dir frontend test:build
 
 # ========== Go Build Stage ==========
-FROM golang:1.25.13-alpine AS builder
+FROM golang:1.25.13-alpine@sha256:1e0126852075c9c60731c8ba49088448b91f63e2aed97ca9d1a9791622a05946 AS builder
 
 # Build arguments for version injection
 ARG VERSION=dev
 ARG COMMIT_SHA=unknown
 ARG BUILD_DATE=unknown
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 
 WORKDIR /app
 
-# Install git for go mod download with private repos
-RUN apk add --no-cache git
-
 # Dependency layer — cached unless go.mod/go.sum change
 COPY backend/go.mod backend/go.sum ./
 COPY backend/internal/pgvector_stub/ ./internal/pgvector_stub/
@@ -36,7 +38,7 @@ COPY backend/ .
 
 # Build with version info injected via ldflags
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-    go build -ldflags="-s -w \
+    go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
     -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
     -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
     -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
@@ -44,7 +46,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
 
 # Build worker binary (same source, --worker-only flag in main)
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-    go build -ldflags="-s -w \
+    go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
     -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
     -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
     -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
@@ -54,7 +56,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
     go build -ldflags="-s -w" -o /migrate ./cmd/migrate/
 
 # ========== Production Stage ==========
-FROM alpine:3.21
+FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
 
 ARG VERSION=dev
 ARG COMMIT_SHA=unknown
@@ -87,7 +89,8 @@ RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app/storage
 USER gochat
 
 # Health check — references the /health endpoint we will add
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3     CMD curl -f http://localhost:3000/ready || exit 1
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -q -T 3 -O /dev/null http://127.0.0.1:3000/ready || exit 1
 
 EXPOSE 3000