chore(docker): standardize on Python 3.14 base image

Bumps all Dockerfile build stages from python:3.11-slim /
python:3.12-slim (and the floating python:3-slim pin, where present)
to python:3.14-slim, pinned by digest (python:3.14-slim@sha256:cea0e60
40540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 - the same
reference digest validated in the caddy-mcp 3.14 pilot,
ca53e55617e3458724ee6a7564f288cc1f08de1c). Bumps requires-python
floor to >=3.12 where it still declared >=3.11, so declared metadata
matches the runtime the fleet actually targets. Upper bound left at
<3.15 (or widened to <3.15 where it had drifted to <3.14) - not
raised further.

Part of the fleet-wide agent-utilities/epistemic-graph Python
version-mismatch fix. Source change only; the k8s hostPath
mount-path migration (python3.11 -> python3.14 site-packages) is a
separate, coordinated rollout tracked outside this commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Knucklessg1

docker/Dockerfile

@@ -15,7 +15,7 @@
 #
 #   docker build --target agent -t gitlab-api:local .
 #   docker build --target mcp   -t gitlab-api:mcp    .
-FROM python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3 AS builder-base
+FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS builder-base
 COPY --from=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a /uv /uvx /bin/
 ENV UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy \
@@ -35,7 +35,7 @@ FROM builder-base AS builder-agent
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv pip install --system --break-system-packages gitlab-api[agent]==26.4.0
 
-FROM python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3 AS runtime-base
+FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS runtime-base
 ARG HOST=127.0.0.1
 ARG PORT=8000
 ARG TRANSPORT="stdio"

docker/debug.Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-slim@sha256:e031123e3d85762b141ad1cbc56452ba69c6e722ebf2f042cc0dc86c47c0d8b3
+FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6
 COPY --from=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a /uv /uvx /bin/
 
 ARG HOST=127.0.0.1

pyproject.toml

@@ -8,7 +8,7 @@ version = "26.4.0"
 description = "GitLab API + MCP Server + A2A Server"
 readme = "README.md"
 classifiers = [ "Development Status :: 5 - Production/Stable", "License :: OSI Approved :: MIT License", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]
-requires-python = ">=3.11, <3.15"
+requires-python = ">=3.12, <3.15"
 dependencies = [ "agent-utilities>=1.27.1,<2.0.0", "python-dotenv>=1.2.2", "gql[requests]>=4.0.0",]
 [[project.authors]]
 name = "Project Maintainers"