The runtime stages shipped node:24.22.1-alpine (Alpine 3.24.2) as built, so CVE-2026-85091 (zlib) and CVE-2026-107891 (musl) were present in all three images. Move to node:24.22.2-alpine (Alpine 3.24.3) and apk upgrade the runtime stage, as the api and auth images already do, so later Alpine fixes land at build time.
Phase 6 of the relay split: the relay's deploy/operate surface moves under cloud/ with 24 cloud-* workflows gated on ORCA_CLOUD_OPERATIONS_ENABLED, the Cloud SQL rollout lease action, the relay Terraform root (dual-accept identities for both repositories), scripts, docs, CODEOWNERS, and a terraform validate job in Cloud Verify.