chore(deps): bump the docker-base-images group across 1 directory with 2 updates

[dependabot]

Bumps the docker-base-images group with 2 updates in the / directory: python and ollama/ollama.

Updates python from a7fb1e6 to ce40764

Updates ollama/ollama from b88c73a to 57d60e6

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

[github-actions]

PR governance metadata gate is not ready for 245c8f1d2177e451e9812525ef6bbd7db9be3e6e:

• Branch is BEHIND the base branch; update the branch and re-run checks.
• Required check strix is FAILURE on the current head.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

Exact-head hosted Strix failure was traced to provider infrastructure: NVIDIA NIM returned repeated HTTP 429 rate limits, the configured fallback also emitted provider failure, and the gate correctly failed closed without authoritative vulnerability evidence. Source checks for 245c8f1d2177e451e9812525ef6bbd7db9be3e6e are otherwise green; failed jobs were retried through the normal Actions API. No bypass or source suppression is warranted.

[seonghobae]

Current-head review disposition

• Exact head: 245c8f1d
• The remaining Dockerfile observation is informational: the Python digest is synchronized across the root image, OCI metadata arguments, and connector image, and the current repository hygiene tests assert that contract.
• No source change is required. The pending strix check must complete normally.

The informational thread is being resolved after this disposition; no approval or check is being fabricated.

[seonghobae]

Exact-head Strix disposition

For exact head 245c8f1d2177e451e9812525ef6bbd7db9be3e6e, Strix failed closed after repeated NVIDIA NIM 429 Too Many Requests; the configured openai-direct/gpt-5.6-luna fallback returned 404 page not found, and no authoritative vulnerability report was produced. The dependency, SAST, build, coverage, and image checks are otherwise green; this is provider infrastructure evidence, not a source finding.

Decision: WAIT_AND_REMEDIATE until a current authoritative Strix result and independent approval exist. No bypass or check suppression is used.