Lint Dockerfile settings (pinned non-latest base image tag, slim/distroless image, non-root USER, pip --no-cache-dir).