fix(release): resolve the release by id, and make the vulnerability gate cover HIGH (#661)

Two release-pipeline defects found while pre-flighting 2.2.0, plus the image
hardening that the second one exposed.

The release job would have died immediately after pushing the v2.2.0 tag.
draftRelease was turned on in #649 and never executed, and GitHub's
/releases/tags/{tag} endpoint does not return draft releases, so all nine tag
lookups in release.yml would have 404'd against the draft semantic-release had
just created. Verified against this repo with a throwaway draft: the tag
endpoint 404s while gh release view reads it and /releases/{id} returns the same
REST shape. Every site now resolves the numeric id first, so existing jq
expressions are untouched.

The unfixed-vulnerability gate was measuring almost nothing. The blocking Trivy
steps run ignore-unfixed, and trivy-unfixed-gate.mjs was meant to cover the
remainder but defaults to CRITICAL with neither call site passing --severity. An
unfixed HIGH was gated by nothing, and the arm64 image carried 79 of them while
the summary read clean.

Rather than document 79 findings, the image lost what it did not need:
libde265 1.1.1 and libheif 1.23.1 are now built from source (the old libheif pin
was itself affected by CVE-2026-3950, and Debian's libde265 1.0.11 was the
decoder every .heic upload actually reached), and xvfb, wget and openssh-client
are purged. 15 CVEs left the image outright and the HIGH gap fell to 65, each
now carrying a rationale verified against the running container.

curl gets its own section: bookworm-backports has a fixed 8.14.1, so claiming no
fix was available would have been false. It is recorded as a declined fix.

Verified on both architectures: gate exits 0, the source-built libde265 is the
one libheif links, and HEIC, RAW, ImageMagick, Sharp AVIF and headless chromium
all still work after the purge.

tests/unit/infra/release-supply-chain.test.ts

@@ -67,7 +67,13 @@ describe("release supply-chain closure", () => {
     expect(release).toContain('git checkout --detach "${release_commit}"');
     expect(release).toContain("node scripts/manage-release-notes.mjs materialize");
     expect(release).toContain('"${VERSION}" /tmp/release-notes.md');
-    expect(release).toContain('grep -Fq "(HTTP 404)" /tmp/release.error');
+    // The release is created as a draft (draftRelease: true), and GitHub's
+    // /releases/tags/{tag} endpoint does not return drafts. Recovery therefore
+    // keys off the release id failing to resolve, not off a 404 from a tag
+    // lookup that can never succeed here.
+    expect(release).toContain('gh release view "v${VERSION}"');
+    expect(release).toContain("--json databaseId");
+    expect(release).toContain('if [[ ! "${release_id}" =~ ^[0-9]+$ ]]; then');
     expect(release).toContain('gh release create "v${VERSION}"');
     expect(release).toContain("--draft");
     expect(release).toContain("--verify-tag");
@@ -77,6 +83,20 @@ describe("release supply-chain closure", () => {
     expect(release).not.toContain("HEAD:main");
   });
 
+  it("never resolves a drafted release through the tag endpoint", () => {
+    // Regression guard. GET /repos/{owner}/{repo}/releases/tags/{tag} returns 404
+    // for a draft, verified against this repo. Every tag lookup in this workflow
+    // ran against the draft semantic-release had just created, so the release job
+    // died immediately after pushing the tag. Resolve the numeric id with
+    // `gh release view` (which reads drafts) and call /releases/{id} instead.
+    const workflow = readRequired(releaseWorkflowPath);
+    const tagLookups = workflow
+      .split("\n")
+      .filter((line) => !line.trimStart().startsWith("#"))
+      .filter((line) => /gh api\b[^\n]*releases\/tags\//.test(line));
+    expect(tagLookups).toEqual([]);
+  });
+
   it("eliminates the arbitrary manual attestation workflow", () => {
     expect(existsSync(manualAttestationPath)).toBe(false);
   });

tests/unit/security/dockerfile-build-args.test.ts

@@ -102,9 +102,18 @@ describe("Dockerfile build args", () => {
       ["Dockerfile.test", dockerfileTest],
     ] as const) {
       expect(source, `${name} must pin libheif bytes`).toContain(
-        "75f530b7154bc93e7ecf846edfc0416bf5f490612de8c45983c36385aa742b42",
+        "0de0327f60fcd47de90d5654c6fe152232738d60d84fe084ec3e0f35e03b166a",
+      );
+      // libde265 is built from source too: Debian 12's 1.0.11 is the decoder a
+      // .heic upload actually reaches, and it carries twelve unfixed advisories.
+      expect(source, `${name} must pin libde265 bytes`).toContain(
+        "fd48a927e94ed74fc7ce8829d222b9d8599fcbfe8b6448ba66705babc56ab219",
       );
       expect(source, `${name} must verify downloads`).toContain("sha256sum --check --strict");
+      // The source build is worthless if libheif silently links the distro copy.
+      expect(source, `${name} must prove libheif linked the source libde265`).toContain(
+        "readelf -d /opt/libheif/lib/libheif.so | grep -q 'NEEDED.*libde265'",
+      );
     }
 
     for (const digest of [