[jmgasper]

Updates vulnerable Forms API and Payload integration dependencies, pins the shared core library to an immutable patched revision, and moves both final images to Node 26.12.1 on Alpine 3.24 as UID 10001. Runtime dependencies remain separate from the migration tools. Neither final image includes npm/pnpm; the ECS migration command now invokes the installed Prisma CLI directly. Both images retain the RDS trust bundle.

The tests now supply the verified machine identity expected by the shared core. PostgreSQL integration tests use real RS256 machine tokens with an isolated JWKS endpoint and an explicit audience; signature, issuer, audience, and conflicting-identity checks remain enabled.

Validation:

• Full pnpm audit: zero critical/high/moderate findings; one low remains.
• Docker lint, Prisma generation, build, typecheck, 68 unit tests, and two matcher compatibility tests pass.
• All 26 PostgreSQL integration tests and six deployment tests pass.
• Final migration image successfully applies all migrations to a fresh database. Final runtime returns readiness 200 and protected endpoint 401 as UID 10001.
• Trivy: zero critical/high/medium OS/application findings in both runtime and migration images.
• No original Dependabot alerts. GitHub code-scanning API reports no analysis found.

No deployment performed.