chore(deps): update all non-major

Author: renovate[bot]

.github/workflows/cd.yml

@@ -60,7 +60,7 @@ jobs:
           driver-opts: network=host
 
       - name: Build dev image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: dev

.github/workflows/deploy-image.yml

@@ -71,7 +71,7 @@ jobs:
       # what min drops is the redundant re-export of intermediate-stage-only
       # layers, which was ~70 s of "writing layer" on every build.
       - name: Build runtime (load)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: runtime
@@ -101,7 +101,7 @@ jobs:
 
       # Build dev (reuses cached `base` layer; see mode=min note above)
       - name: Build dev (load)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: dev
@@ -159,7 +159,7 @@ jobs:
 
       - name: Push runtime
         if: github.event_name == 'push'
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: runtime
@@ -170,7 +170,7 @@ jobs:
 
       - name: Push dev
         if: github.event_name == 'push'
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: dev

Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.25
 #
 # Two-target image:
 #   --target runtime  →  minimal, for canfar batch jobs and downstream stacks