fix(mcp): drop npm from the runtime image, bump tar to 7.5.22

Defender for Cloud reports CVEs against the mcp container image that the
repo scanners cannot see. The subassessment evidence paths split them in two:

  /usr/local/lib/node_modules/npm/**  - the npm 10.9.8 that node:22-slim
  bundles, vendoring @sigstore/core 2.0.0, brace-expansion 2.0.2, tar 7.5.11
  (critical), sigstore, picomatch, ip-address, plus npm itself (high, no fix
  available). Present in all 20 images including the current one. Dependabot
  reads package-lock.json, so none of this is visible to it.

  /app/node_modules/**  - body-parser 2.2.2, fast-uri 3.1.2, hono, protobufjs,
  tar 7.5.16, all confined to images from 2026-07-21 and earlier and already
  fixed by 7df208fa/c3e9621a. Those findings age out with the old ACR tags.

npm is build-time only here: CMD is `node dist/index.js`, the HEALTHCHECK is
`node -e`, the container app spec overrides no command and probes over HTTP,
and src/ contains no child_process call. So remove npm rather than upgrade it
- npm 11.x still vendors @sigstore/core 3.1.0, itself inside the vulnerable
<= 3.2.0 range, and would clear nothing.

Separately, tar 7.5.20 -> 7.5.22 in our own tree (GHSA-r292-9mhp-454m, via
@huggingface/transformers -> onnxruntime-node). 7.5.22 satisfies the declared
^7.0.1, so no override is needed. fast-uri deliberately stays on 3.1.4: it is
patched against all four fast-uri advisories, and ajv 8.18.0 declares ^3.0.1,
so forcing 4.x would be an override against a major range.

npm audit --omit=dev: 0 vulnerabilities. tsc clean, 455 tests pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/McpServer/autopilot-monitor-mcp/Dockerfile

@@ -70,7 +70,20 @@ ENV NODE_ENV=production
 ENV HF_CACHE_DIR=/app/.hf-cache
 
 COPY --from=build /app/package.json /app/package-lock.json ./
-RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
+# npm is a BUILD-time tool only: the runtime is `node dist/index.js`, the
+# HEALTHCHECK is `node -e`, and the server never shells out (no child_process
+# anywhere in src/). But the npm that node:22-slim bundles carries its own
+# vendored dependency tree under /usr/local/lib/node_modules/npm, and a
+# container image scanner reports every CVE in it against this image —
+# @sigstore/core, brace-expansion, tar, sigstore, picomatch, ip-address, plus
+# npm itself, none of which appear in our package-lock and none of which
+# Dependabot can see.
+#
+# Removing npm clears all of them; upgrading it does not (npm 11.x still
+# vendors @sigstore/core 3.1.0, inside the vulnerable <= 3.2.0 range). The rm
+# must share this RUN so the deletion lands in the same layer as the install.
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force && \
+  rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 COPY --from=build /app/dist/ ./dist/
 COPY --from=build /app/.hf-cache/ ./.hf-cache/

src/McpServer/autopilot-monitor-mcp/package-lock.json

@@ -3772,9 +3772,9 @@
       "license": "MIT"
     },
     "node_modules/tar": {
-      "version": "7.5.20",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz",
-      "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",