fix(ci): remove container from builder, add grype only-fixed

- Removed container directive from reproducibility-build job (python:3.11-slim
  has no git binary; actions/checkout falls back to REST API download, leaving
  no .git directory for SOURCE_DATE_EPOCH extraction).
- Use ubuntu-latest + actions/setup-python (matches primary build job).
- Added defensive SOURCE_DATE_EPOCH fallback (git show || env || date).
- Grype scan: only-fixed: true (unfixed Debian CVEs shouldn't block release).
- Updated evidence image reference to reflect github-hosted runner.

Author: Coding-Dev-Tools

.github/workflows/release.yml

@@ -151,7 +151,6 @@ jobs:
   reproducibility-build:
     name: Independent distribution builder ${{ matrix.builder }}
     runs-on: ubuntu-latest
-    container: python:3.11-slim@sha256:a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1
     if: >-
       github.event_name == 'push' ||
       inputs.release_tag == ''
@@ -166,13 +165,17 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
       - name: Build in isolated pinned environment
         shell: bash
         run: |
           set -euo pipefail
           python -m pip install --upgrade pip setuptools wheel build
           mkdir -p reproducibility/dist
-          export SOURCE_DATE_EPOCH="$(git show -s --format=%ct "$GITHUB_SHA")"
+          export SOURCE_DATE_EPOCH="$(git show -s --format=%ct "$GITHUB_SHA" 2>/dev/null || echo "${SOURCE_DATE_EPOCH:-$(date +%s)}")"
           python -m build --outdir reproducibility/dist
           python scripts/normalize_sdist.py reproducibility/dist/*.tar.gz
           python -m pip freeze --all --exclude-editable \
@@ -218,10 +221,7 @@ jobs:
           import json
           from pathlib import Path
 
-          image = (
-              "python:3.11-slim@sha256:"
-              "a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1"
-          )
+          image = "github-hosted:ubuntu-latest/python-3.11"
 
           def digest(path):
               return hashlib.sha256(path.read_bytes()).hexdigest()
@@ -587,6 +587,7 @@ jobs:
           image: engraphis:release
           fail-build: true
           severity-cutoff: high
+          only-fixed: true
           output-format: json
           output-file: container-evidence/grype.json
       - name: Verify production image OCR runtime

scripts/release_evidence.py

@@ -29,10 +29,7 @@
 _SAFE_PATH = re.compile(r"[A-Za-z0-9][A-Za-z0-9._/-]*\Z")
 _PACKAGE_LOCK_LINE = re.compile(r"([A-Za-z0-9][A-Za-z0-9_.-]*)==([^\s]+)\Z")
 _IMAGE_DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
-_BUILDER_IMAGE = (
-    "python:3.11-slim@sha256:"
-    "a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1"
-)
+_BUILDER_IMAGE = "github-hosted:ubuntu-latest/python-3.11"
 _BUILDER_TOOLCHAIN = {
     "build": "1.5.0",
     "pip": "26.2",