deps: consolidate tool updates and refresh container security packages

[bifrost0x]

Consolidates #213 and #214 and fixes the CI failures exposed by the combined update.

• Update Graphify 0.9.53 → 0.9.58, ESLint 10.9.1 → 10.10.0, and Playwright 1.62.1 → 1.63.0.
• Regenerate the universal Python 3.11+ Graphify lock, preserving version markers, transitive pins and hash enforcement; update both Graphify policy tests.
• Prevent stale OS package updates in container builds. The failed scan reused cached apt upgrade layers in both Docker stages. Pass a workflow-run/attempt cache key into both stages for AMD64, ARM64 and publishing, so each new CI attempt refreshes Debian packages. See Docker cache invalidation.
• Keep severity thresholds, both architecture gates, scan artifacts and the publish gate intact. Add a policy regression check for package-update freshness.

Validation already completed:

• 125 browser tests and all 43 JavaScript test files passed for the combined dependency update.
• ESLint, all 10 vendored-asset checks and the Graphify build/Pages asset checks passed.
• Hash-verified Graphify installation and dependency checks passed on Python 3.11 and 3.14; lock regeneration matches exactly.
• 59 supply-chain and dependency policy tests passed with the CI fix.
• Full local Python suite: 2,827 passed, 2 skipped.
• Independent read-only patch review found no concrete regression or surviving CI cache path.
• The GitHub Tests workflow passed on commit 0a86657, including browser, SSH/SMB, Redis and container lifecycle tests. Both AMD64 and ARM64 container scans passed after installing the fixed Debian package versions. The aggregate image-security gate and its complete workflow also passed.

Supersedes #213 and #214.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T07:01:28.805497Z	7db05d1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7db05d186e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".