v0.28.0 — AlmaLinux 10 base image + Python 3.14

Highlights

Runtime base image: Debian → AlmaLinux 10-minimal, Python 3.13 → 3.14 (ADR-0069 / TICKET-020).

The migration cuts Trivy OS-package noise at the root: AlmaLinux ships authoritative OVAL/ALSA errata with backport-aware fix-state, instead of the Debian tracker's "affects package, no fix planned" entries that Trivy surfaces forever. First AlmaLinux scan vs. the Debian baseline: image OS findings 45 → 16 (all openssl-libs, every one with an ALSA fix available → cleared on a base refresh), filesystem findings 2 → 0.

Changed

• Base image python:3.13-slim-trixie → almalinux:10-minimal (builder on almalinux:10). Interpreter Python 3.14 (EL10 ships no 3.13). No libpq (psycopg[binary] bundles it), no curl; the container HEALTHCHECK uses a Python urllib probe. entrypoint.sh and the scratch-flatten final stage are kept; builder and runtime share /usr/bin/python3.14 so the venv needs no relocation.
• Python floor raised to 3.14 everywhere: requires-python>=3.14, ruff target-version=py314, mypy python_version=3.14, CI setup-python 3.14. ruff pinned to ==0.15.13 for deterministic format/lint.
• Agent scan hardening (ADR-0067): trivy rootfs / now excludes container-runtime data-roots (/var/lib/docker, containerd stores, /var/lib/containers) and passes an explicit --timeout; new FM_SCAN_SKIP_DIRS / FM_SCAN_TIMEOUT operator overrides. Fixes a silent 5-minute scan timeout on container hosts.
• Dependencies: cryptography 48.0.0 → 48.0.1 (GHSA-537c-gmf6-5ccf, HIGH), pydantic-settings 2.14.1 → 2.14.2 (GHSA-4xgf-cpjx-pc3j); uv.lock resynced with pyproject.
• Image-size DoD cap raised 200 → 256 MB (the AlmaLinux userland is larger than Debian-slim; the venv is the bulk).
• CI: BuildKit type=gha cache disabled on the self-hosted runner — on the Hetzner ARC runner the transatlantic cache import (~0.29 MB/s for the ~82 MB layer) was slower than a full cold build.
• .trivyignore: dropped the now-moot ~90-entry Debian-tracker list — AlmaLinux findings are fixable via errata, not suppressed.

Notes

• The 16 remaining openssl-libs image findings clear automatically once almalinux:10-minimal ships the openssl -4.el10_2 errata build (base refresh; no code change).
• Air-gap: mirror the almalinux:10 / almalinux:10-minimal base images into the internal registry (see docs/operations.md).

Full changelog: v0.27.1...v0.28.0