build(test-infra): pin container base images and package downloads by hash

Resolves the two open Pinned-Dependencies code-scanning alerts (and one
sibling the scanner had not flagged yet):

- ubuntu:noble in Dockerfile and Dockerfile.lint is pinned to its
  multi-arch manifest-list digest (verified against the registry and the
  scanner's remediation digest, which match).
- mstorsjo/llvm-mingw drops the floating :latest and pins the current
  digest the same way.
- The MSYS2 zlib sysroot package in Dockerfile.mingw is verified against
  a pinned sha256 before extraction instead of piping the download
  straight into tar.

Dockerfile.alpine was already pinned; both rebuilt images (test, lint)
verified building with the new digests.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

test-infrastructure/Dockerfile

@@ -6,7 +6,9 @@
 # Build:  docker build -t cbm-test test-infrastructure/
 # Run:    docker run --rm -v $(pwd):/src cbm-test
 
-FROM ubuntu:noble
+# Pinned by digest (supply-chain: no floating tags) — multi-arch manifest-list
+# digest of ubuntu:noble as of 2026-07-23; bump deliberately, never to a tag.
+FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
 
 # Minimal: gcc + zlib only. sqlite3 is vendored (compiled from source with ASan).
 # curl + zsh mirror the GitHub runner images: the self-update tests shell out

test-infrastructure/Dockerfile.lint

@@ -5,7 +5,9 @@
 # Build:  docker build -t cbm-lint -f test-infrastructure/Dockerfile.lint test-infrastructure/
 # Run:    docker run --rm -v $(pwd):/src cbm-lint
 
-FROM ubuntu:noble
+# Pinned by digest (supply-chain: no floating tags) — multi-arch manifest-list
+# digest of ubuntu:noble as of 2026-07-23; bump deliberately, never to a tag.
+FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc g++ make cmake \

test-infrastructure/Dockerfile.mingw

@@ -7,7 +7,10 @@
 #   docker compose -f test-infrastructure/docker-compose.yml run --rm build-windows
 #   docker compose -f test-infrastructure/docker-compose.yml run --rm test-windows
 
-FROM mstorsjo/llvm-mingw:latest
+# Pinned by digest (supply-chain: no floating tags). This is the multi-arch
+# manifest-list digest of mstorsjo/llvm-mingw:latest as of 2026-07-23; bump
+# deliberately by re-resolving the digest, never back to a bare tag.
+FROM mstorsjo/llvm-mingw:latest@sha256:5cbf421906f889e01c8d4005787474e302df6daa197286ebf212d419024966af
 
 # curl+zstd are required (zlib sysroot fetch below). Wine is BEST-EFFORT: it
 # only runs the .exe, and its i386 packages are unavailable on an arm64 Docker
@@ -19,10 +22,16 @@ RUN (dpkg --add-architecture i386 && apt-get update && \
      apt-get install -y --no-install-recommends wine64 && rm -rf /var/lib/apt/lists/*) \
     || echo "WARN: Wine unavailable on this host arch -> compile-only mode"
 
-# Install zlib into the llvm-mingw sysroot (from MSYS2 CLANG64 repo)
+# Install zlib into the llvm-mingw sysroot (from MSYS2 CLANG64 repo).
+# The package is verified against its pinned sha256 before extraction —
+# a bare curl|tar would execute whatever the mirror serves.
 RUN mkdir -p /tmp/zlib-pkg && \
     curl -sL "https://mirror.msys2.org/mingw/clang64/mingw-w64-clang-x86_64-zlib-1.3.1-1-any.pkg.tar.zst" \
-    | zstd -d | tar xf - -C /tmp/zlib-pkg && \
+    -o /tmp/zlib.pkg.tar.zst && \
+    echo "b7f0c06e6d48128209a3a441f96b92351e565a0d031278c56a8db8a9b5ec291a  /tmp/zlib.pkg.tar.zst" \
+    | sha256sum -c - && \
+    zstd -d < /tmp/zlib.pkg.tar.zst | tar xf - -C /tmp/zlib-pkg && \
+    rm /tmp/zlib.pkg.tar.zst && \
     cp -rn /tmp/zlib-pkg/clang64/include/* /opt/llvm-mingw/x86_64-w64-mingw32/include/ && \
     cp -rn /tmp/zlib-pkg/clang64/lib/* /opt/llvm-mingw/x86_64-w64-mingw32/lib/ && \
     rm -rf /tmp/zlib-pkg