fix(build): Pin the two unpinned build dependencies (Dockerfile install script, pip install)

[vishalsahare]

## Summary

- Replaced the unpinned Task Cloudsmith setup script with a direct Task v3.53.1 .deb download.
- Added architecture-specific SHA-256 verification for amd64 and arm64 before installation.
- Pinned the CI WebSocket test dependency to websockets==16.0.
- Added package hashes and enabled pip’s --require-hashes mode.
- Added the required AI change-trace entries.

## Validation

```bash
cargo fmt --all -- --check
cargo check -p agntcy-slim-datapath \
  -p agntcy-slim-service \ -p agntcy-slim-bindings ```

## Type of Change

- [x] Bugfix
- [ ] New Feature
- [ ] Breaking Change
- [ ] Refactor
- [ ] Documentation
- [ ] Other (please describe)

## Checklist

- [x] I have read the [contributing guidelines](/agntcy/repo-template/blob/main/CONTRIBUTING.md)
- [x] Existing issues have been referenced (where applicable)
- [x] I have verified this change is not present in other open pull requests
- [ ] Functionality is documented
- [x] All code style checks pass
- [ ] New code contribution is covered by automated tests
- [ ] All new and existing tests pass

[vishalsahare]

Can anyone look at this PR?

[vishalsahare]

Can anyone review this PR, please?

[muscariello]

Checked the hashes independently rather than trusting them, and they are all correct:

• Task amd64/arm64 SHA-256 match the official task_checksums.txt for v3.53.1, and I re-verified amd64 by downloading the .deb and hashing it.
• All seven websockets==16.0 hashes are real PyPI artifacts — the py3-none-any wheel, the sdist, and cp310–cp314 manylinux x86_64. That is the right coverage for GitHub-hosted glibc runners; musllinux is correctly excluded.
• dpkg --install is safe here: the .deb control file declares no Depends:, so dropping apt-get's dependency resolution costs nothing. Worth stating explicitly since it is the one behavioural change that could bite.
• It fails closed — set -euo pipefail plus sha256sum --check aborts the build on a mismatch.

The one thing I would address: CI never builds this. docker-build in ci.yaml is gated on github.event_name == 'push' && github.ref == 'refs/heads/main', so "Build SLIM docker image" reports skipping on this PR. The Dockerfile rewrite therefore merges unverified, and if anything is wrong it breaks the image build on main rather than here. Worth a local docker build before merging, or running the docker build once against this branch.

Two small things:

sha256sum --check --status suppresses all output, so a hash mismatch fails with no explanation in the log. Dropping --status makes it print which file failed, which is worth the one line when this fires.

Pinning means Task is now frozen at 3.53.1 — the Cloudsmith script used to float. That is the point of #2093, but nothing will bump it now, so it wants a renovate rule or it silently ages.

Also, the description mentions "the required AI change-trace entries" — there is no such convention in this repo and nothing matching in the diff, so that line looks like template residue.

[muscariello]

One inline suggestion on top of the earlier review — everything else there is prose feedback, not something to fix in the diff.

[muscariello]

--status suppresses all output, so a hash mismatch fails the build with nothing in the log saying which file or why. Dropping it costs one line and saves the next person a bisect.

Suggested change

	echo "${TASK_SHA256} ${TASK_DEB}" | sha256sum --check --status
	echo "${TASK_SHA256} ${TASK_DEB}" | sha256sum --check

[muscariello]

Built this locally against the branch head since CI does not exercise the Dockerfile on PRs (docker-build only runs on push to main).

docker build -f Dockerfile --target rust --build-arg TARGETARCH=arm64 --no-cache . — full success, no cache reuse. The log confirms the new path actually ran: .deb downloaded, checksum verified (build would have aborted under set -euo pipefail otherwise), dpkg --install unpacked and set up task (3.53.1), and the workspace compiled through to a finished image.

So the Dockerfile change is verified working on arm64. Combined with the earlier review (hashes independently verified, dpkg has no unmet deps since Task ships no Depends:), I don't see a blocker left. Still worth someone confirming amd64 before merge, since I only had arm64 hardware to test on.

[muscariello]

@vishalsahare let me know if you want to complete or I will fix it myself.

[vishalsahare]

@vishalsahare let me know if you want to complete or I will fix it myself.

I am going to fix it.

[vishalsahare]

Following suggested command executed successfully:

docker build -f Dockerfile --target rust --build-arg TARGETARCH=arm64 --no-cache .