fix(ci): pin semantic-release preset and repair python/php image builds after base drift

.github/workflows/docker-publish.yml

@@ -124,7 +124,19 @@ jobs:
             echo "is_release=false" >> $GITHUB_OUTPUT
           fi
           echo "image_tag=${TAG}" >> $GITHUB_OUTPUT
-          echo "runner_image=ghcr.io/${OWNER_LC}/kubecoderun-runner:${TAG}" >> $GITHUB_OUTPUT
+          # Language images do `FROM runner_image`. Point them at ${TAG} only
+          # when that tag will actually exist in this run: the runner build
+          # job creates it when docker/runner/** changed (or force_all), and
+          # retag-runner creates it on releases. Otherwise (a PR or main push
+          # touching a language Dockerfile but not the runner) fall back to
+          # :latest - the last released runner - since nothing pushes a
+          # dev-${SHORT_SHA} runner tag in that run.
+          if [[ "${{ steps.filter.outputs.runner }}" == "true" || "${{ github.event.inputs.force_all }}" == "true" || "${{ github.ref }}" == refs/tags/* ]]; then
+            RUNNER_TAG="${TAG}"
+          else
+            RUNNER_TAG="latest"
+          fi
+          echo "runner_image=ghcr.io/${OWNER_LC}/kubecoderun-runner:${RUNNER_TAG}" >> $GITHUB_OUTPUT
 
   # ==================== Build Jobs ====================
   # Note: All build jobs skip when is_cross_repo_pr == 'true' (cross-repo PRs can't push to upstream registry)

.github/workflows/release.yml

@@ -31,8 +31,11 @@ jobs:
           node-version: "lts/*"
 
       - name: Install semantic-release
+        # Pinned: conventional-changelog-conventionalcommits@10 requires
+        # conventional-changelog-writer@9, but @semantic-release/release-notes-generator
+        # still bundles writer@8 - the unpinned combo broke generateNotes on 2026-09-16.
         run: |
-          npm install -g semantic-release conventional-changelog-conventionalcommits
+          npm install -g semantic-release@25.0.9 conventional-changelog-conventionalcommits@9.3.1
 
       - name: Get latest release before
         id: before

docker/php.Dockerfile

@@ -28,11 +28,12 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Copy PHP installation from DHI PHP image
 COPY --from=php-source /opt/php-8.5 /opt/php-8.5
-# Copy shared libraries PHP depends on (avoids chasing individual packages)
-COPY --from=php-source /usr/lib/x86_64-linux-gnu/libargon2.so* /usr/lib/x86_64-linux-gnu/
-COPY --from=php-source /usr/lib/x86_64-linux-gnu/libsodium.so* /usr/lib/x86_64-linux-gnu/
-COPY --from=php-source /usr/lib/x86_64-linux-gnu/libicu*.so* /usr/lib/x86_64-linux-gnu/
-COPY --from=php-source /usr/lib/x86_64-linux-gnu/libonig.so* /usr/lib/x86_64-linux-gnu/
+# Copy shared libraries PHP depends on (avoids chasing individual packages).
+# The multiarch dir differs per platform (x86_64-linux-gnu vs
+# aarch64-linux-gnu), so glob it and land the libs in /usr/local/lib, which
+# is on the default ld.so search path for either arch. The compile steps
+# below run ldconfig before first invoking php.
+COPY --from=php-source /usr/lib/*-linux-gnu/libargon2.so* /usr/lib/*-linux-gnu/libsodium.so* /usr/lib/*-linux-gnu/libicu*.so* /usr/lib/*-linux-gnu/libonig.so* /usr/local/lib/
 
 # Put PHP in PATH for build steps
 ENV PATH="/opt/php-8.5/bin:${PATH}"

docker/python.Dockerfile

@@ -25,7 +25,12 @@ RUN apt-get update && \
     g++ \
     make \
     pkg-config \
-    python3-dev \
+    # NOTE: no python3-dev here - Debian's python3 (3.13) chain CONFLICTS with
+    # the DHI python-3.14 packages and apt resolves it by REMOVING python 3.14
+    # entirely ("python: command not found"). The image already ships
+    # python-3.14-dev / libpython-3.14-dev. Same reason portaudio19-dev and
+    # libpulse-dev were dropped below: their chains pull Debian python3 and
+    # nothing in requirements/ compiles against them.
     # Development libraries (runtime libs installed in final stage)
     libxml2-dev \
     libxslt-dev \
@@ -38,8 +43,6 @@ RUN apt-get update && \
     libfreetype6-dev \
     liblcms2-dev \
     libwebp-dev \
-    portaudio19-dev \
-    libpulse-dev \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
@@ -135,10 +138,13 @@ COPY --from=runtime-deps /usr/lib/aarch64-linux-gnu /usr/lib/aarch64-linux-gnu
 COPY --from=runtime-deps /usr/bin/pdftotext /usr/bin/pdftoppm /usr/bin/pdfinfo /usr/bin/
 COPY --from=runtime-deps /usr/bin/ffmpeg /usr/bin/ffprobe /usr/bin/
 
-# Copy installed Python packages from builder
-# DHI Python is installed in /opt/python, not /usr/local
-COPY --from=builder /opt/python/lib/python3.14/site-packages /opt/python/lib/python3.14/site-packages
-COPY --from=builder /opt/python/bin /opt/python/bin
+# Copy installed Python packages from builder.
+# DHI python >=3.14.7 is packaged under /usr (interpreter at /usr/bin/python,
+# site-packages at /usr/lib/python3.14/site-packages); the old /opt/python
+# layout no longer exists. Console-script shims are not carried over - the
+# runner invokes `python {file}` and library use is import-based (`python -m
+# pip` still works since the upgraded pip lands in site-packages).
+COPY --from=builder /usr/lib/python3.14/site-packages /usr/lib/python3.14/site-packages
 
 # Copy /usr/bin/env for ENTRYPOINT
 COPY --from=runtime-deps /usr/bin/env /usr/bin/
@@ -150,7 +156,7 @@ WORKDIR /mnt/data
 
 # Sanitized environment via env -i
 ENTRYPOINT ["/usr/bin/env", "-i", \
-    "PATH=/opt/python/bin:/usr/bin:/bin", \
+    "PATH=/usr/bin:/bin", \
     "HOME=/tmp", \
     "TMPDIR=/tmp", \
     "PYTHONUNBUFFERED=1", \