build(docker): lock core runtime dependencies

docker/core.Dockerfile

@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1
 FROM node:22.19.0-bookworm-slim AS node-runtime
-
-RUN npm install --global --ignore-scripts --no-audit --no-fund \
-      @earendil-works/pi-coding-agent@0.80.3 \
-    && pi --version
+WORKDIR /opt/pi-runtime
+COPY docker/pi-runtime/package.json docker/pi-runtime/package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
+    && ./node_modules/.bin/pi --version
 
 FROM node:22.19.0-bookworm-slim AS backend-build
 WORKDIR /src/backend
@@ -28,16 +28,19 @@ RUN apt-get update \
     && chown -R thoth:thoth /data
 
 COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
-COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
-RUN ln -s /usr/local/lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi \
+COPY --from=node-runtime /opt/pi-runtime /opt/pi-runtime
+RUN ln -s /opt/pi-runtime/node_modules/.bin/pi /usr/local/bin/pi \
     && node --version \
     && pi --version
 
 WORKDIR /app
 COPY harness/ /app/harness/
 COPY --from=gate-deps /src/harness/node_modules /app/harness/node_modules
+COPY docker/python-runtime/requirements.lock /app/docker/python-runtime/requirements.lock
 RUN python -m venv /opt/venv \
-    && /opt/venv/bin/pip install --no-cache-dir /app/harness
+    && /opt/venv/bin/pip install --no-cache-dir --require-hashes \
+      --requirement /app/docker/python-runtime/requirements.lock \
+    && /opt/venv/bin/pip install --no-cache-dir --no-deps --no-build-isolation /app/harness
 
 COPY --from=backend-build /src/backend/dist /app/backend/dist
 COPY --from=backend-build /src/backend/node_modules /app/backend/node_modules