Investigate Alpine/musl base for schema-service and prediction workers

[roman1887]

Problem

Follow-on to #243. Those four images carry the same 7 CRITICAL / ~23 HIGH from the Debian base (perl-base, libc6), none of which have an upstream fix, and none of which come from Actyze code.

Affected:

• schema-service
• prediction-worker-xgboost
• prediction-worker-lightgbm
• prediction-worker-autogluon

Moving them to python:3.13-alpine would take each from 7 CRITICAL to 0, on the same evidence as #243:

Base image	Total	CRITICAL	HIGH
python:3.13-slim (current)	174	7	23
python:3.13-alpine	11	0	3

Why this is separate from #243

Nexus was verified to resolve cleanly on Alpine. These four almost certainly will not, and the work is real rather than mechanical.

Alpine uses musl, so every wheel must be musllinux. These services depend on the heavy scientific stack:

Package	Service	Risk
torch	schema-service, autogluon	CPU wheels are published for manylinux; musllinux availability needs checking
faiss-cpu	schema-service	historically manylinux only
sentence-transformers	schema-service	pure Python, but pulls torch
xgboost-cpu	xgboost worker	check musllinux
lightgbm	lightgbm worker	needs libgomp; Alpine ships it as libgomp
autogluon.timeseries	autogluon	large tree, weakest link decides

Where a musllinux wheel does not exist, pip compiles from source. For torch or faiss that is slow enough to be impractical in CI and may not build at all.

Suggested approach

1. Per service, run a resolution check before writing any Dockerfile:

   docker run --rm -v "$PWD/schema-service/requirements.txt:/r.txt:ro" python:3.13-alpine \
     sh -c 'apk add --no-cache build-base; pip install --dry-run -r /r.txt'

2. Migrate whichever services resolve. Partial migration is worthwhile — each one moved is 7 CRITICALs removed from that image.
3. For any service that cannot move, record it in security/CONTAINER_SECURITY.md with the blocking package, so the residual findings are explained rather than unexplained.

Alternatives if musl proves impractical

• Wolfi (cgr.dev/chainguard/wolfi-base) — glibc, so manylinux wheels work, and it tracks CVE fixes far faster than Debian stable. Chainguard's pre-built language images now require authentication (403 Forbidden on cgr.dev/chainguard/python:latest), but the wolfi base is usable and Python can be installed with apk. Most promising option for the ML services.
• Rebuild python:3.13-slim on Debian testing/sid — picks up fixes earlier at the cost of stability. Not recommended for a product image.
• Accept and document. These are unfixable upstream, and the same findings appear in any Debian-based image, including competitors'. Recording that clearly is a legitimate outcome — but it should be a decision, not a default.

Related: #243, #241