PatchPilot: remediate CVEs

[moolen]

• Updated Dockerfile base images to golang:1.25.8 and alpine:3.20 to pick up patched Go stdlib and OS packages.
• Upgraded Go dependencies for CVE fixes (logrus, glog, x/net, x/text, protobuf) and refreshed go.sum.
• Test: go test ./... (fails: pkg/store/fs/store_test.go has an unconditional t.Fail()).

[moolen]

Restored Dockerfile after CI failure caused by invalid base image and preserved the existing remediation changes.

[moolen]

• Updated cosign installer to sigstore/cosign-installer@v3 and cosign release to v3.0.5 to resolve the sigstore TUF invalid key signing failure from the outdated v1.12.1.
• Added COSIGN_YES=true to signing and attestation steps to keep non-interactive CI behavior consistent with newer cosign.
• Tests not run (workflow change only).

[moolen]

Codex was invoked in headless mode but did not write .patchpilot/output.json before returning.

This wrapper synthesized the required response so PatchPilot can continue the reconciliation flow.

Failing jobs: sign

Tracked changes:
(no tracked file changes detected)

[moolen]

Codex was invoked in headless mode but did not write .patchpilot/output.json before returning.

This wrapper synthesized the required response so PatchPilot can continue the reconciliation flow.

Failing jobs: sign

Tracked changes:
(no tracked file changes detected)