fix(egress): harden runtime image

[prazgaitis]

What changed

• build the egress and supervisor binaries with Go 1.26.5 on Alpine
• replace the broad Debian runtime/toolbox with a pinned Wolfi base and only the packages required by enforcement and transparent proxying
• upgrade mitmproxy from 11.0.2 to 12.2.3
• refresh the Go dependency graph to the latest compatible security-patched versions

Why

The published Debian image inherits Critical and High findings from packages that the egress runtime does not use. The smaller runtime removes that unnecessary attack surface while preserving the DNS, nftables, transparent-MITM, credential-injection, and supervisor contracts.

Validation

• go test ./... — all packages passed
• 54 real mitmproxy credential, redaction, traversal, and streaming tests — passed inside the built image
• live DNS default-deny smoke — passed (google.com denied, api.github.com allowed)
• live nftables policy/update smoke — passed, including CIDR, DoT, wildcard override, delete, and dynamic always-rule reload
• native linux/arm64 image build — passed
• Trivy 0.66: 0 Critical / 5 High; OS and both Go binaries are clean

The five residual High findings are mitmproxy transitive Python packages. Current mitmproxy 12.2.3 caps cryptography <=48.1, msgpack <=1.1.2, and tornado <=6.5.5, below the scanner's fixed versions. This PR does not force unsupported dependency overrides; those findings require a compatible mitmproxy release or a separately reviewed exception.