fix(deps): bump OpenTofu to 1.12.6 and Helm to 3.22.0

[gdrojas]

What

Bump two pinned binaries in docker/containers.Dockerfile:

-ARG TOFU_VERSION=1.10.6
+ARG TOFU_VERSION=1.12.6
-ARG HELM_VERSION=3.15.4
+ARG HELM_VERSION=3.22.0

This file carries the note "review/pin these versions to what the scopes actually target" — this is that review.

Why

None of the vulnerabilities Trivy reports against scopes/containers are in our code. All 147 live in four binaries baked into the image, and the dominant package in each is stdlib — the Go standard library the binary was compiled with.

Binary	Findings	Cause
tofu	54	built with Go 1.24.6
helm	52	built with Go 1.22.6
kubectl	32	built with Go 1.22.5
np	9	comes from the base image

Measured by scanning each candidate binary inside an identical image:

Bump	Findings
tofu 1.10.6 → 1.12.6	54 → 13
helm 3.15.4 → 3.22.0	52 → 0

This also reaches scopes/containers-datadog, which is FROM this image and inherits both pins.

Risk

Helm stays on the 3.x line — not a v4 migration. OpenTofu moves two minors inside 1.x.

Worth noting: this binary runs tofu apply against customer state, so please run the scope test suite before merging rather than treating it as a routine bump. That is the main reason this is not split into two trivial PRs.

kubectl left alone, deliberately

kubectl accounts for 32 findings and is not touched. No version below 1.37.0 clears them:

kubectl	Go	Findings
1.30.4 (current)	—	32
1.33.6	1.24.9	29
1.35.5	1.25.9	21
1.36.3	1.26.5	14
1.37.0	1.26.6	0

1.30.4 → 1.37.0 is a seven-minor jump that breaks kubectl supported version skew against customer clusters. That is a compatibility decision, not a dependency bump, so it is left for a separate conversation.

np (9 findings) comes from scopes/worker-bridge and has to be fixed there.

Verified

All four artifacts return HTTP 200 — tofu_1.12.6_linux_{amd64,arm64}.tar.gz and helm-v3.22.0-linux-{amd64,arm64}.tar.gz. The build is multi-arch and needs both.

🤖 Generated with Claude Code