Replace the brittle release-specific patch with an idempotent semantic Dockerfile transformation. Preserve the upstream package-manager version, reuse an existing npm refresh, and fail closed when required runtime anchors disappear.
Resolve the highest published DSH version, add scheduled component update checks, rebalance the workstation toolset, and retain the existing runtime and workstation targets.
Remove Rust/Cargo, restore pinned npm, add checksum-pinned development tools, build actionlint with the pinned Go toolchain, and reduce the workstation image by about 505 MiB while preserving cross-platform node-pty assets.
Validated by component-pin checks, runtime/workstation builds and smoke tests, dependency audits, Caddy checks, and Trivy gates.
Build committed amd64 runtime and workstation inputs without publishing, then exercise the existing dependency, smoke, Caddy, toolchain, and Trivy gates. Pin the Docker-socket Trivy fallback image by digest across the DeepSeek Harness workflows.
okxlin