build(deps): refresh Ubuntu Noble runtime base

[shiny-code-app]

The published runtime still contains linux-libc-dev 6.8.0-146.146 from the October 11 Ubuntu snapshot, blocking downstream image verification. Refresh the official Ubuntu Noble runtime base to its current multi-platform digest. The normal post-merge build uses a fresh apt snapshot and publishes the corrected package for downstream consumers; the digest change alone is not proof of remediation.

Closes #121. Downstream publication and verification remain tracked in cbusillo/odoo-enterprise-docker#57. This PR changes one Dockerfile line and preserves the existing vulnerability policies, runtime paths and pip-free Python contract.

Local arm64 validation at 425ec4f, with apt snapshot 20261014T000000Z:

• Runtime and runtime-devtools builds and smoke checks pass.
• Database initialization/health and downstream helper checks pass.
• Both images contain linux-libc-dev 6.8.0-147.147. Pinned Trivy 0.74.0 scans with the existing policy report zero fixable HIGH/CRITICAL findings; both repository absolute dependency gates pass.
• Requirements override, dependency health and wrapper tests, Hadolint and diff checks pass.

Anthropic claude-opus-5-5 reviewed this head read-only. Its package-provenance caution is reflected above. Registry inspection confirms the digest is an OCI index containing amd64 and arm64 manifests; the review's conditional single-architecture concern is resolved. The pre-existing resolver image pin is outside this one-line refresh. No tests were added.

PyCharm changed/whole-project inspection UNKNOWN: resolve-route reports target_project_not_open for the exact worktree, and the Supervisor brief prohibits opening the desktop IDE. No native inspection ran. CI amd64 verification remains required. README and workflow metadata were checked; contracts and gate routing remain unchanged. Background review is not yet observable.

Client test notes

Nothing for the Client to test for this base-image dependency refresh. Image build, smoke, database, downstream-helper and vulnerability gates provide engineering verification. No Client acceptance is required for this infrastructure update; no Client runtime is deployed by this PR.

[shiny-code-app]

Ready for the merge train

Head: 425ec4f

[shiny-code-app]

Launchplane completed the merge-train step for this pull request.

• Repository: cbusillo/odoo-docker
• Base branch: main
• Pull request: build(deps): refresh Ubuntu Noble runtime base #122
• Controller action: land_batch
• Controller record: merge-train-batch-landing-plan-20261015T014957Z-a281e7858bb87a4d

Launchplane finished the merge-train step for this pull request.

Launchplane manages this comment and will update it as the train moves.