release/0.3.1
main
fix(#14): distroless debian13 runtime for node-webapp
debian12 ships libssl3 3.0.18 with open HIGH/CRITICAL CVEs that fail the Trivy gate; debian13 scans clean. Closes #14
chore: back-merge v0.3.0