build: bump python from cea0e60 to a7fb1e6

[dependabot]

Bumps python from cea0e60 to a7fb1e6.

[cdeust]

ZETETIC-REVIEW: REQUEST_CHANGES

Stakes: Low (single digest bump duplicated across builder/runtime stages, root Dockerfile, no runtime logic change).

Digest verification (point 1)

Resolved python:3.14-slim live against registry-1.docker.io (OCI index manifest, docker-content-digest header): current tag resolves to sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc — exact match to the new digest in this diff, both FROM lines. Python major.minor (3.14) is unchanged; only the underlying image content moved. Correct. Unlike #421/#423, the source comment block above this FROM (Dockerfile:24-27, "different python:3.14-slim... source: .../3.14-slim, ... re-verified 2026-07-28") already correctly names 3.14 — no comment-drift finding here.

Blocking — branch is stale against origin/main, both repo gates fail as currently constituted

origin/main is 3 commits ahead of this PR's merge-base (e88e4e21): #331, #419, #427 — the latter two shrank .craftsmanship-baseline.json and re-tightened .claude-plugin/marketplace.json. Ran both gates against the current head of this branch (088cf395):

• python3 scripts/check_craftsmanship.py --base origin/main → exit 1, "baseline entries ADDED without a base-ref match" (7 entries the PR branch's stale baseline carries that main's shrunk baseline no longer has).
• python3 scripts/check_marketplace_pins.py → exit 1, 2 stale pins (hypermnesia-mcp-viz 3.0.0 vs v3.1.0, zetetic-team-subagents 2.36.0 vs v2.37.0) — both already fixed on origin/main.
• Confirmed clean baseline on origin/main itself (exit 0 both gates) — this is not pre-existing repo debt, it is this branch trailing main.

GitHub's green check ran against the PR's stale base, not current origin/main; merging as-is will red-X on the next gate run. @dependabot rebase (or a maintainer merge of main) resolves this — no manual edit needed for this PR beyond the rebase itself.

Non-blocking (point 3)

Confirms #421/#423's framing: three genuinely distinct Dockerfiles (production vs devcontainer vs docker/ full-stack image), sharing the same upstream python:3.14-slim tag by coincidence of build strategy, not by duplication that should be collapsed. No action needed here.

Required to unblock: rebase onto current origin/main so both repo gates pass clean. No content defect in this diff itself.

[cdeust]

@dependabot recreate

[cdeust]

Fermée : la recréation par dependabot n'a pas résolu l'échec.

Le job Docker Smoke (bare-container DB-less contract) retombe sur la tête recréée 52199fb8. La cause est établie et sans rapport avec ce bump : scripts/docker_smoke.sh fermait le stdin du conteneur dès la fin de l'écriture des requêtes — or fermer stdin est le signal d'arrêt du protocole MCP — ce qui pouvait annuler la réponse à tools/list avant qu'elle soit écrite. Signature correspondante : « no valid tools/list response (id=3) », stderr vide, aucune trame d'erreur. Mesuré à une occurrence sur cinq sur main lui-même.

Le correctif est en PR #428, avec une reproduction déterministe qui pilote le vrai SDK et perd la réponse dans la forme « écrire puis fermer », la conserve dans la forme « vider puis fermer ».

Cette PR est donc fermée plutôt que relancée indéfiniment contre une porte défectueuse. Dependabot la recréera au prochain digest, sur un dépôt où le job ne tire plus au sort.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.