chore(docker): Pin Docker base images with SHA256 digests

[petteriTeikari]

Problem

All Dockerfiles use tag-based pinning (e.g., python:3.11-slim-bookworm, rocker/tidyverse:4.5.2) rather than cryptographic digest pinning. Docker Hub can re-tag images, meaning the same tag may resolve to different images over time.

This violates the project's explicit reproducibility mandate (see docs/tutorials/reproducibility.md, docs/repo-figures/fig-repro-18-base-image-problem.md).

Current State

File	Image	Pin Type
Dockerfile:22	python:3.11-slim-bookworm	Tag only
Dockerfile:50	rocker/tidyverse:4.5.2	Tag only
Dockerfile.test:12,26	python:3.11-slim-bookworm	Tag only
Dockerfile.r:19	rocker/tidyverse:4.5.2	Tag only
Dockerfile.shiny:15	rocker/shiny:4.5.2	Tag only

Expected

Pin with SHA256 digests:

FROM python:3.11-slim-bookworm@sha256:abc123...
FROM rocker/tidyverse:4.5.2@sha256:def456...

Priority

MEDIUM — current tags are consistent (R=4.5.2 everywhere, Python=3.11), but image mutability is a latent reproducibility risk.

Discovered during version pinning audit (FAILURE-007).

🤖 Generated with Claude Code

[petteriTeikari]

Not addressed in PR #26 (CI/CD fixes). PR #26 focused on:

• Docker build reliability (disk cleanup + retry logic)
• DuckDB artifact commitment
• Test suite hardening

SHA256 digest pinning is a separate reproducibility improvement — keeping this open for future work.

[petteriTeikari]

Related: #45 covers Docker image security hardening (hardened base images, container scanning, non-root, distroless runtime) for deployment scenarios. Digest pinning (#43) and hardened images (#45) are complementary — one ensures reproducibility, the other ensures security.