Inspector: CVEs in the CP container images

Security Hub's Inspector findings (security account, 2026-10-17) that Task 6630 did not take: (1) every CP container image in prod's and dev's ECR carries the same 7 HIGH + 2 MEDIUM + 2 LOW findings, almost all in the base image's `util-linux 2.38.1` and `zlib 1.2.13` (Debian bookworm; Inspector reports no fixed version) — decide the base image's next line (trixie, or a distroless/slim variant that drops util-linux) for infra/local/Dockerfile.api and Dockerfile.frontend, rebuild, and confirm the findings drop on the new digests; (2) the three hosting-account nodes launched from `ami-080341f184b848d0b` each carry 3 MEDIUM OS findings — bump the CP-launched node AMI pin (docs/compliance/system-description.md names a 30-day AMI cadence) and confirm the findings close on the replacement hosts. The headscale hosts and bastions were patched by Task 6630 and are not part of this. Out of scope: the application's own Python/Node dependencies (dependency scanning covers them), the GuardDuty rules, and any Security Hub standards control. Done means: - `aws ecr describe-image-scan-findings` (or the Inspector findings in Security Hub) on the newest api and frontend image digests in dev shows no HIGH finding in util-linux or zlib. - The hosting-account node AMI pin is bumped in its single home and the three nodes' Inspector MEDIUM findings are archived or resolved.

api image moved to Wolfi (trixie still had zlib/glibc HIGH): dev eb5df45890 scans 0 findings. Node pip CVEs (Ubuntu Pro-only fix) suppressed by Inspector rule, R-SOC-47; no AMI pin exists (resolved per launch). PRs #5597+#5626 merged, gate green, Deploy success. Draft 6668.