Refresh util-linux security packages in runtime image

[cbusillo]

Summary

• explicitly refresh the nine installed util-linux binary packages affected by CVE-2026-53615
• invalidate the stale final-runtime apt layer in both CI and deployment caches without disabling BuildKit caching
• add a final-stage Dockerfile contract test so the security-upgrade package set cannot silently drift into a builder stage

Context

Post-merge Launchplane CI run 31992091598 found nine HIGH findings at installed version 2.41-5. Debian trixie-security now publishes fixed version 2.41.5-0+deb13u1. The existing Dockerfile already runs apt-get update and apt-get upgrade, but the unchanged RUN instruction was eligible for reuse from GHA and registry BuildKit caches.

Validation

• uv run --extra dev python -m unittest tests.test_service_image_contract — 3 passed
• uv run --extra dev ruff check --no-fix tests/test_service_image_contract.py — passed
• uv run --extra dev ruff format --check tests/test_service_image_contract.py — passed
• git diff --check — passed
• Opus and Gemini approved the remediation plan before implementation

The PR intentionally does not suppress the CVE, disable caching, roll back the Owner cutover, refresh VeriReel PR #343, or contact an Owner.

Refs #2164