fix: pin Docker base images to currently-published tags (python/uv/node)

Dockerfile

@@ -3,11 +3,11 @@
 # Rebuild 2026-04-13: initial release
 
 # ── Stage 1: Build Hermes Agent from source ──────────────────────────────
-FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie AS uv_source
+FROM ghcr.io/astral-sh/uv:0.11-python3.13-trixie AS uv_source
 FROM tianon/gosu:1.19-trixie AS gosu_source
-FROM node:22.16.0-trixie-slim AS node_source
+FROM node:22-trixie-slim AS node_source
 
-FROM python:3.13.5-slim-trixie
+FROM python:3.13-slim-trixie
 SHELL ["/bin/bash", "-c"]
 
 ENV PYTHONUNBUFFERED=1
@@ -32,8 +32,8 @@ COPY --chmod=0755 --from=node_source /usr/local/bin/node /usr/local/bin/node
 COPY --from=node_source /usr/local/lib/node_modules /usr/local/lib/node_modules
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
   && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
-  && test "$(python --version 2>&1)" = "Python 3.13.5" \
-  && test "$(node --version)" = "v22.16.0"
+  && [[ "$(python --version 2>&1)" == "Python 3.13."* ]] \
+  && [[ "$(node --version)" == v22.* ]]
 
 # ── Clone and build Hermes Agent (P1-T01 pinable upstream) ──────────────
 ARG HERMES_UPSTREAM_REPO=https://github.com/NousResearch/hermes-agent.git