chore(events-processor): drop Dockerfile.staging

[IxDay]

Removes events-processor/Dockerfile.staging (47 lines, one file).

Requires getlago/lago-deploy#3611 to merge first — that PR repoints the staging build workflow at events-processor/Dockerfile. Merging this one first leaves the staging workflow pointing at a file that no longer exists.

Why it can go

Dockerfile.staging existed for exactly one reason: staging needed a Wolfi build while production was still on Debian. #811 hardened the production Dockerfile onto the same lago-packages bases, making the two near-duplicates — and the production one is strictly better:

	Dockerfile (prod)	Dockerfile.staging (removed)
base pin	immutable lago-packages commit	:latest
LAGO_EXPRESSION_REF	commit sha	git checkout v0.2.0 — a repointable tag
source fetch	git fetch --depth 1 <sha>	git clone --tags (every branch and tag)
integrity	go mod verify, explicit CGO_ENABLED=1	—
labels	OCI source / description / licence	—

Staging keeps its role

The one genuine difference — staging riding the daily lago-packages CVE rebuild while prod stays reproducible — is preserved in lago-deploy#3611 as build-args on the same Dockerfile:

build-args: |
  BUILD_IMAGE=ghcr.io/getlago/events-processor-build:latest
  RUNTIME_IMAGE=ghcr.io/getlago/events-processor-base:latest

One override instead of 47 duplicated lines. Staging remains the canary for base bumps, and it also gains the sha-pinned expression ref.

Already validated in production

The production Dockerfile this consolidates onto is live in both prod clusters as of today:

prod-us-1   lago-events-processor:sha-e399abb   1/1 Running, 0 restarts
prod-eu-1   lago-events-processor:sha-e399abb   2/2 Running, 0 restarts
runAsUser=65532  readOnlyRootFS=true  caps.drop=[ALL]  seccomp=RuntimeDefault

It cleared 13 critical + 58 high findings.

🤖 Generated with Claude Code