fix: upgrade pip to ≥26.1.2 across all service Dockerfiles (CVE-2026-8643)

[Copilot]

python:3.11-slim-bookworm ships pip 24.0, which is vulnerable to CVE-2026-8643 — a path traversal flaw where console_scripts/gui_scripts entry points are treated as paths, enabling arbitrary file writes outside the install directory during wheel installation.

Changes

• All 7 service Dockerfiles (orchestrator, pod-worker, audit-worker, api-gateway, protocol-bus-mcp, dashboard, agent-runtime) get two new RUN lines:
  • Stage 1 (builder) — upgrades pip inside the venv before installing requirements
  • Stage 2 (runtime) — upgrades the system pip before ENV PATH=/opt/venv/bin:$PATH takes effect, targeting the /usr/local/lib/python3.11/site-packages/pip location that Trivy scans

# Stage 1: upgrade pip in the venv
RUN python -m venv /opt/venv
ENV PATH=/opt/venv/bin:$PATH
RUN pip install --no-cache-dir --upgrade "pip>=26.1.2"   # ← added

# Stage 2: upgrade system pip before venv PATH is applied
WORKDIR /app
RUN pip install --no-cache-dir --upgrade "pip>=26.1.2"   # ← added
ENV PATH=/opt/venv/bin:$PATH

[codesyncapp]

Check out the playback for this Pull Request here.