Replace eclipse-temurin:21-jre-alpine (musl) with cgr.dev/chainguard/jre:openjdk-21 (Wolfi/glibc, daily CVE refresh, signed images + SBOM). Remove the dead ENTRYPOINT block — DeploymentExecutor overrides it at container creation anyway. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>