Outbound TLS in this image still trusted the compromised eMudhra roots (`emSign ECC Root CA - G3` and `Comodo AAA Services`).
- Image install now upgrades `ca-certificates` and regenerates the trust bundle.
- `certifi` is locked at 2026.10.23, which drops those roots for `requests` and `httpx`.
Merge this, then redeploy beta and prod.
Reviewed-on: #19
Unignore site/ (was blocked by mkdocs /site rule), add compose/Docker/uv tooling, and split deploys so push to main goes to beta while prod stays manual.
westfarn