20260902 完成公开树清理与热点拆分

docker/base-images.toml

@@ -1,6 +1,5 @@
-# M4 staging build inputs. Replace tags with immutable digest references before M7.
-# The digest and verification date are intentionally empty until the release
-# registry/base-image policy is approved.
+# Development build inputs. A supported release must use immutable digest
+# references and record their verification in release provenance.
 builder_image = "rust:1-bookworm"
 runtime_image = "debian:bookworm-slim"
 builder_digest = ""

docker/validator-runtime.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-# Staging defaults. M7 release builds must replace these tags with pinned
+# Development defaults. A supported release must replace these tags with
 # immutable references recorded in docker/base-images.toml.
 ARG BUILDER_IMAGE=rust:1-bookworm
 ARG RUNTIME_IMAGE=debian:bookworm-slim