[nicolasriverocorvalan]

Moves the gateway and plugin runtime images to Docker Hardened distroless bases (dhi.io/static, glibc variant for the gateway). The images no longer contain a shell, package manager, or curl. This takes the Docker Scout result from 92 vulnerabilities (19 critical) to 0 critical / 0 high for both images.

• compose healthchecks now call the binaries (/app healthcheck, /bin/gateway healthcheck) because there is no shell for curl
• plugins move to Go 1.26 with patched x/crypto, x/net and otel. gRPC is pinned to v1.83.2 because 1.84.0 is still affected by CVE-2026-84445; keep the pin until 1.85 ships
• build_push.yml and e2e.yml log in to dhi.io. The dead attestation steps in build_push.yml are removed

Validated in k8s dev using image tags:
v0.2.22-rc
v0.2.22-rc-1
v0.2.22-rc-2

The new images are about half the size overall: the gateway is 73% smaller to download and the plugin 22%:
- Gateway: almost all the saving comes from dropping the debian:trixie-slim base, which carried a shell, coreutils, apt, dpkg and so on. The glibc distroless base keeps only libc, libgcc, CA certs and tzdata
- Plugin: the 33 MB Go binary is most of the image. The Alpine base with curl and its libraries is gone. The binary grew by 0.75 MB because of the newer dependencies (Go 1.26, x/crypto 0.57, and so on)

• Go 1.26 deprecates the ecdsa.PublicKey.X / .Y fields: the auth plugin now rejects a JWK whose coordinates are not 32 bytes or whose point is not on the curve, with an error while loading the JWKS. Before, such a key was accepted and every PAT signed with it failed later as "invalid signature". Our issuer always publishes valid, padded points, so real traffic is unaffected