fix(remediation): path-bind dockerfile_pin clear-evidence

[alimobrem]

Summary

• dockerfile_pin binds each container :latest finding to its Dockerfile/Containerfile path — pinning Dockerfile alone no longer clears :latest on Dockerfile.deps / .fast (pulse-agent#2 class)
• HEALTHCHECK / USER(root) findings refuse via dockerfile_pin (finding/patch mismatch); non-UBI findings require a UBI/Red Hat FROM on the finding's file
• Extends tip fix(remediation): harden clear-evidence for shallow Scan PRs #200 clear-evidence harden; does not merge [AgentIT] Scan container: source-repo patch for pulse-agent PulseSRE/pulse-agent#2 (requesting changes there)

Test plan

• Inline verifier checks (multi-Dockerfile overclaim FAIL / single-file PASS / HEALTHCHECK mismatch)
• CI test + browser-critical + image-smoke-test + scan green
• ./scripts/ci-merge-gate.sh <N> then merge
• Tip note after merge; pulse-agent#2 changes-requested comment

Made with Cursor

[alimobrem]

Tip note

Merged path-bound dockerfile_pin clear-evidence (#201).

• Each container :latest finding must have its Dockerfile/Containerfile staged and pinned — pinning Dockerfile alone cannot clear Dockerfile.deps / .fast
• HEALTHCHECK / USER(root) refuse via dockerfile_pin (mismatch); non-UBI requires UBI/Red Hat FROM on that file
• Builds on tip fix(remediation): harden clear-evidence for shallow Scan PRs #200 shallow clear-evidence harden
• [AgentIT] Scan container: source-repo patch for pulse-agent PulseSRE/pulse-agent#2: changes-requested comments left; do not merge that PR as-is