chore(deps): bump virtualenv from 21.14.12 to 21.14.13 (#427)

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.14.12 to 21.14.13.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.12...21.14.13)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Require `certifi>=2026.10.19`, upgrade the image's `pip`, and pin SDK…

… to `v3.6.1` (#418)

* Bump the Socket Python SDK to 3.6.1

uv.lock still resolves socketdev 3.6.0: relock with
`uv lock --upgrade-package socketdev` once 3.6.1 is on PyPI.

* Require certifi>=2026.10.19 and upgrade the image's pip

certifi only came in through requests, so pip installs of socketsecurity
could keep a CA bundle that trusts the compromised eMudhra intermediates;
only the Docker image's lockfile pinned it. Add a floor to the package's
dependencies.

The image's pip (26.2.1) uses its own vendored CA bundle and still trusted
them. Upgrade it to 26.2.2 or newer against the fixed system store, and
have dockerfile-smoke require pip to reject the test hosts too.

* Lock socketdev 3.6.1

Stop trusting the compromised eMudhra intermediate CAs (#415)

* Stop trusting the compromised eMudhra intermediate CAs

Require Alpine ca-certificates 20261020-r0+ in the image, bump certifi to
2026.10.19, point Node at the system store with NODE_OPTIONS=--use-openssl-ca
until Node ships its fix, and bump the bundled uv to 0.13.4.

* Install Node from the official node image

Alpine's nodejs package is still 24.18.1, which trusts the compromised
eMudhra intermediates. node:24-alpine3.24 ships Node 24.22.1, which rejects
them, so copy Node, npm, corepack and yarn from it and fail the build below
24.22.1. That makes the NODE_OPTIONS=--use-openssl-ca workaround and its
entrypoint handling unnecessary, so drop both.

* Smoke-test the Docker image on arm64 and check its TLS clients

dockerfile-smoke only built the image on amd64 and ran nothing in it, so
an arm64 break or a regression in the image's CA trust would first show up
in release.yml. Build on native amd64 and arm64 runners, check the bundled
tools run, and require curl, Node and Python requests to reject the eMudhra
test hosts while still reaching api.socket.dev, npm and PyPI. Also run it
when the entrypoint script changes.

Bump pinned Coana CLI to 15.12.10 (#412)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

Bump pinned @coana-tech/cli to 15.12.8 (#408)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

Bump pinned @coana-tech/cli to 15.12.7 (#395)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

Bump pinned @coana-tech/cli to 15.12.3 (#391)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

Bump pinned @coana-tech/cli to 15.12.1 (#389)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

Bump pinned @coana-tech/cli to 15.11.6 (#386)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Bump pinned @coana-tech/cli to 15.11.5 (#384)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>