fix: refresh outbound HTTPS trust and installer bootstrap

.github/workflows/ci.yml

@@ -93,7 +93,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22.23.4"
       - run: npm ci --ignore-scripts --no-audit --no-fund
       - name: Check frontend architecture
         run: node scripts/check_frontend.mjs
@@ -160,15 +160,18 @@ jobs:
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         if: steps.docs-check.outputs.docs_only != 'true'
         with:
+          version: "0.13.4"
           enable-cache: true
           cache-dependency-glob: requirements.txt
           prune-cache: false
-      - run: uv pip install --system -r requirements.txt
+      - run: |
+          uv pip install --system --require-hashes --only-binary=:all: --no-deps -r requirements-bootstrap.txt
+          uv pip install --system -r requirements.txt
         if: steps.docs-check.outputs.docs_only != 'true'
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         if: steps.docs-check.outputs.docs_only != 'true'
         with:
-          node-version: "20"
+          node-version: "22.23.4"
           cache: npm
       - run: npm ci
         if: steps.docs-check.outputs.docs_only != 'true'
@@ -190,10 +193,14 @@ jobs:
         if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ffmpeg bubblewrap
+          sudo apt-get install -y --no-install-recommends ffmpeg bubblewrap ca-certificates
           command -v ffmpeg
           ffmpeg -version | head -n 1
 
+      - name: Validate Python and system CA trust
+        if: steps.docs-check.outputs.docs_only != 'true'
+        run: python scripts/check_ca_trust.py --system --python
+
       - name: Establish functional bubblewrap containment
         if: steps.docs-check.outputs.docs_only != 'true'
         shell: bash

.github/workflows/dependency-review.yml

@@ -70,5 +70,9 @@ jobs:
       - name: Run pip-audit on requirements
         run: |
           set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ca-certificates
+          python scripts/check_ca_trust.py --system
+          python -m pip install --require-hashes --only-binary=:all: --no-deps -r requirements-bootstrap.txt
           pip install pip-audit==2.10.0
           pip-audit -r requirements.txt -r requirements-optional.txt --strict

.github/workflows/docker-publish.yml

@@ -65,6 +65,7 @@ jobs:
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
+          pull: true
           platforms: ${{ matrix.platform }}
           outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=${{ matrix.arch }}

.github/workflows/workflow-security.yml

@@ -76,5 +76,9 @@ jobs:
       - name: Run zizmor
         run: |
           set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ca-certificates
+          python scripts/check_ca_trust.py --system
+          python -m pip install --require-hashes --only-binary=:all: --no-deps -r requirements-bootstrap.txt
           pip install zizmor==1.25.2
           zizmor --offline --min-severity=low .github/workflows/