fix: harden blueprint deployment guardrails (#1027)

* fix: harden blueprint deployment guardrails

* fix: update Docker toolchain to Go 1.26.3

* fix: repair Dockerfile tr argument split across lines

* fix: bump protobufjs to clear npm audit high-severity advisories

backend/src/services/BlueprintAnalyzer.ts

@@ -17,6 +17,7 @@ interface ComposeShape {
 }
 
 interface ComposeService {
+    image?: string | null;
     volumes?: Array<string | ComposeServiceVolume> | null;
     tmpfs?: string | string[] | null;
 }
@@ -208,6 +209,20 @@ export class BlueprintAnalyzer {
         return false;
     }
 
+    static extractImageRefs(composeContent: string): string[] {
+        const doc = (parseYaml(composeContent) ?? {}) as ComposeShape;
+        const services = doc.services ?? {};
+        const seen = new Set<string>();
+        const images: string[] = [];
+        for (const serviceDef of Object.values(services)) {
+            const image = typeof serviceDef?.image === 'string' ? serviceDef.image.trim() : '';
+            if (!image || image.startsWith('sha256:') || seen.has(image)) continue;
+            seen.add(image);
+            images.push(image);
+        }
+        return images;
+    }
+
     private static extractNamedVolumes(composeContent: string): Set<string> {
         try {
             const doc = (parseYaml(composeContent) ?? {}) as ComposeShape;