chore(deps): pin non-major docker dependencies

docker/Dockerfile

@@ -20,7 +20,7 @@ RUN set -eux; \
 # in the SAME logical line as the pinned checkout+build — a later RUN cannot swap
 # the binary and recompute the baseline.
 
-FROM node:24-bookworm-slim AS base
+FROM node:24.22.0-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5 AS base
 ARG TPS_VERSION=0.5.4
 # The shipped path installs the PUBLISHED @tpsdev-ai/agent version supplied by
 # docker.yml's workflow dispatch input as TPS_VERSION. The workflow checks that

docker/soundstage.Dockerfile

@@ -4,7 +4,7 @@
 # Includes: Node 22, OpenClaw CLI, bash, git
 # No outbound network needed at runtime.
 
-FROM node:22-alpine
+FROM node:22.23.3-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402
 
 # Install system deps needed by openclaw (koffi needs cmake + build tools)
 RUN apk add --no-cache git bash cmake make g++ python3 linux-headers && \

docker/tps-office.Dockerfile

@@ -1,5 +1,5 @@
 # CP32 Branch Office image
-FROM node:24-bookworm-slim AS base
+FROM node:24.22.0-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5 AS base
 
 # Security: no root package installs after this layer
 # Harden: disable npm update notifier, reduce attack surface