[atomantic]

Summary

• Moves the pinned pgvector/pgvector:pg17 digest (docker-compose.yml, the CI database service in ci.yml, and scripts/lib/dbImage.js for the restore test) to the newest upstream rebuild. It ships the Debian perl fix and is otherwise identical for existing data volumes: PostgreSQL 17.11, pgvector 0.8.7, Debian 12 and the same glibc; the new image starts and CREATE EXTENSION vector works. Rescanning with the workflow's pinned syft 1.55.0 / grype 0.121.0 (same DB) drops pgvector from 537 to 472 matches and criticals from 29 to 9 (the perl criticals and 65 matches in total are gone), identically on amd64 and arm64.
• Fills docker/runtime-image-security.reviews.json with a reviewed disposition for every remaining match: 472 for pgvector and 201 for supercollider, each scoped to target, advisory, package and installed version. Run through the script's own verify --strict against the new pgvector scans and the first run's SuperCollider scans, both architectures: 0 unreviewed.
• Triage rules are in a new "Ledger triage" section of docs/GITHUB_ACTIONS.md. not-reachable is a package not loaded by the long-running process (verified with ldd over bin/postgres, lib/*.so and libpq for pgvector, and over the runtime package chain for SuperCollider) and not run by the entrypoint, probe or PortOS; blocked is a loaded package with no Debian fix, or a fix upstream has not shipped yet.
• The 68 matches that already have an upstream fix (gosu's Go stdlib, libsasl2, apt in pgvector; zlib1g in the SuperCollider base) cannot be cleared by a pin move today: pg17 already resolves to the digest adopted here and debian:trixie-slim still resolves to the pinned base. They are blocked on Drop runtime-image ledger blocks once upstream pgvector and Debian base images ship fixes #15669, which lists the next step and removes them once a rebuilt image is adopted. I did not move the SuperCollider snapshot: the recipe keeps it equal to the base image's own timestamp, and a newer snapshot would not pull zlib1g without an extra upgrade step.
• New test: the shipped ledger has unique keys, a derived target, a pinned package version and a #N tracker reference per entry.

Test plan

• npm run pregate green (lint, structural guards, focused server tests).
• scripts/runtime-image-security.test.js and scripts/dbImageDigestPin.test.js pass.
• Local syft + grype scans of the new digest on both architectures; strict verify passes for pgvector and supercollider on both.
• The scheduled strict run can still fail later on advisories published after this ledger was written; that is the intended behavior and new matches need their own review.

Local review

Reviewer gpt-6.1-terra (effort high), 1 round, input head 410127e7ff3cf9b6a6a38f3ac177aa2502205e93: verdict clean, no findings. The first call with the full diff reported incomplete coverage because the 280 KB generated ledger exceeded the reviewer's context, so the reviewed diff excludes docker/runtime-image-security.reviews.json; the ledger was validated by the script's schema checks, the new test and the strict verify runs above instead.

Closes #15662