fix(deploy): harden Cloud Run image against known CVEs

[liamhelmer]

Summary

• Switch runtime base from node:22-bookworm to node:22-bookworm-slim, eliminating ~30+ CVEs from imagemagick, libheif, libde265, openexr, openjpeg, and other image-processing libraries not needed for a CLI agent
• Add apt-get upgrade -y to all apt install layers to pick up available OS security patches (libpng, gnutls, etc.)
• Upgrade Python packages (pip, setuptools, wheel, cryptography) to fix CRITICAL/HIGH CVEs

Test plan

• E2E test (deploy/cloudrun/test-e2e.sh) passes — image builds, container starts, agent-card validates, A2A round-trip succeeds (all 17 checks pass)
• Rebuild and re-scan image in Artifact Registry to confirm reduced CVE count