fix: remove gosu (Go 1.24.4 CVEs) — use runuser instead, CRITICAL 4→3, HIGH 12→5

backend/Dockerfile

@@ -30,10 +30,9 @@ RUN groupadd -r agent && useradd -r -g agent -d /app -s /bin/bash agent && \
 # Generate OCI Terraform resource reference at build time
 RUN python gen_tf_reference.py || echo "WARN: tf reference generation skipped (terraform init may need network)"
 
-# Entrypoint: fix /data ownership then exec as agent user
-RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec gosu agent "$@"\n' > /entrypoint.sh && \
-    chmod +x /entrypoint.sh && \
-    apt-get update && apt-get install -y --no-install-recommends gosu && rm -rf /var/lib/apt/lists/*
+# Entrypoint: fix /data ownership then drop to agent user (no gosu needed)
+RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec runuser -u agent -- "$@"\n' > /entrypoint.sh && \
+    chmod +x /entrypoint.sh
 
 VOLUME /data
 ENTRYPOINT ["/entrypoint.sh"]