fix(infra): publish CVE-fixed CHIRP UHRP images

[ty-everett]

Program and scope

• Tracker or issue: Protected Infra Release run 33030009215; CHIRP provider rollout requested by the operator.
• Program gate(s) advanced: Restore the signed OCI release path for the merged CHIRP-capable UHRP services.
• Why this change is needed: Trivy correctly blocked UHRP Basic 0.1.33 and UHRP Cloud 0.2.35 because Alpine shipped libcrypto3 and libssl3 3.5.7-r0, affected by CVE-2026-14456. Both runtime images now install the fixed 3.5.8-r0 packages explicitly and receive patch-version bumps.
• Explicitly out of scope: CHIRP protocol/API changes, storage migration, direct workstation publication, and deployment of downstream providers.
• Exact head SHA reviewed: 9712e7e9977e3f4b2ae8190b3ee5da662c5a2451

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only through the release workflow after approval):

• @bsv/uhrp-server-basic: 0.1.34 OCI image
• @bsv/uhrp-server-cloud-bucket: 0.2.36 OCI image
• No npm package version or public API change

Verification

• Local commands and results:
  • pnpm health:check: 184/184 governance tests pass; 39 projects, 32 public packages, 0 contract findings, 0 control errors.
  • pnpm docs:build: 117 routes and 122 HTML files built; policy, facts, prerender, search, and link checks pass.
  • pnpm format:check: pass across all workspaces.
  • Basic: npm ci --ignore-scripts, npm audit, npm run build, npm run lint, npm test: 8 suites / 36 tests pass; 0 vulnerabilities.
  • Cloud: npm ci --ignore-scripts, npm rebuild better-sqlite3, npm audit, npm run build, npm run lint, npm test: 8 suites / 29 tests pass; 0 vulnerabilities.
  • pnpm audit:security: policy pass with the two existing governed high-severity advisories ignored.
  • git diff --check: pass.
  • A broad local pnpm typecheck was also attempted; it progressed through the affected CHIRP package and UHRP builds but requires generated outputs from unrelated packages when run outside the governed build/typecheck ordering. Exact affected-scope CI remains authoritative.
• Hosted CI run: All exact-head checks passed on CI run 33030706119; runtime contracts passed in run 33030706267.
• Conformance evidence: CHIRP conformance was green on merged PR feat(storage): add CHIRP reference implementation #494; this patch changes only OS runtime packages and service patch versions.
• Coverage delta: No production TypeScript lines changed.
• Lint/typecheck delta: Both affected services build and lint cleanly; no TypeScript source changed.
• Browser/mobile/packed-consumer evidence: Not applicable to runtime-image-only change.
• Performance or bundle-size delta: No application bundle change; image layer adds exact patched Alpine OpenSSL runtime packages.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings (including accepted or false-positive issue states) and zero unreviewed hotspots; Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: Alpine OpenSSL 3.5.8-r0 fixes CVE-2026-14456, the exact finding that blocked protected run 33030009215.
• Runtime, build, and peer compatibility: The existing immutable Node 24 Alpine base is retained; only libcrypto3 and libssl3 are upgraded to their compatible patched revision.
• Deduplicated lockfile: npm dependency graph is unchanged; lockfiles contain only the required service patch-version update.
• Audit and CodeQL: Standalone service audits report 0 vulnerabilities. Hosted CodeQL and Trivy remain required before merge/release.
• Package and consumer tests: Basic 36/36 and Cloud 29/29 tests pass, with builds and lint clean.
• Bundle and performance impact: No JS bundle change; an explicit patched Alpine package layer is added.
• Affected public package versions: None. OCI service versions become Basic 0.1.34, Cloud 0.2.36.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

The protected Infra Release workflow must rebuild Linux/amd64 images, scan them before push, then publish their SBOMs, provenance, signatures, and immutable tags. Rollback remains the previous signed image digest; no storage or configuration migration is involved.

The companion freshness changes renew the expired documentation verification dates and the test-quality/exception review windows after their inventories and repository-health controls were revalidated locally.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code, passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is being handed to another contributor as “complete”
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud