chore(build): re-run OS package upgrades on every image build

[jfrench9]

Summary

Ensures OS-level security patches actually land in every image build. The runner stage runs apk upgrade --no-cache, but with GHA layer caching (--cache-from type=gha) that layer is reused from cache and never re-executes — upgrades only landed when the base image digest happened to move. This is why the image scanner kept reporting OS package findings that a fresh build would have cleared.

Changes

Dockerfile

• Adds an ARG CACHE_DATE consumed at the start of the runner stage's apk upgrade layer, so a changed value invalidates the layer (and everything after it, including the npm install -g npm@latest refresh).

.github/workflows/build.yml

• Passes --build-arg CACHE_DATE=$(date -u +%Y%m%d) to the buildx invocation — the layer re-runs on the first build of each UTC day; same-day rebuilds keep full cache benefit.

Testing

• Pre-commit gate (format, lint, typecheck, tests, cf-lint) green. The behavior change itself is exercised by the next image build; current open image-scan findings will close once a fresh image is built, scanned, and deployed.