ci: harden daily Docker dependency updater

[fqjony]

Summary

• Run Docker dependency-update checks daily at 05:00 UTC.
• Restrict the updater to Dockerfile edits and source hosts declared in that Dockerfile.
• Replace the stale dev.kit context with generated Rabbit CI delivery metadata.

Scope

• Changed: scheduled Docker dependency-updater workflow, Rabbit CI repository metadata, and README guidance.
• Not changed: worker runtime behavior, image-release workflow, or dependency versions.

Validation

• Parsed the workflow YAML and checked the embedded Bash and Node scripts.
• Verified the non-APT inventory against the current Dockerfile.
• Regenerated .rabbit/repo.yaml from the current GitHub delivery configuration and confirmed a stable dry run.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[Copilot]

Pull request overview

This PR hardens the GitHub Actions workflow that probes Dockerfile dependencies and opens an automated, Dockerfile-only update PR, and documents the updater behavior in the README.

Changes:

• Switch the dependency updater schedule to run daily at 05:00 UTC.
• Tighten Copilot CLI execution by validating inputs, limiting allowed URLs to those found in the Dockerfile report, and guarding against non-Dockerfile changes (including staged changes).
• Extend the dependency report to include an inventory of Dockerfile ARG pins and URL sources, and document the updater behavior in README.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
README.md	Documents when/how the Docker dependency updater runs and what it does.
.github/workflows/docker-dependency-updater.yml	Hardens the scheduled dependency-updater workflow, adds non-APT inventory to the report, and tightens Copilot execution/guards.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/docker-dependency-updater.yml:223

• This step runs an inline Node script to inventory Dockerfile ARGs/URLs, but Node isn’t set up/pinned until later (actions/setup-node). That makes the probe depend on whatever Node version happens to be preinstalled on the runner image and can drift/break independently of the pinned Node 22 used later in the job.

          node <<'NODE' > "${non_apt_path}"
          const fs = require("node:fs");

          const dockerfile = fs.readFileSync(process.env.DOCKERFILE, "utf8");
          const pins = [];