Complete RC6 supply chain gates

deploy/unraid/Dockerfile.all-in-one

@@ -1,8 +1,8 @@
 FROM node:20-alpine AS frontend-build
 
 WORKDIR /frontend
-COPY frontend/package.json frontend/package-lock.json* ./
-RUN npm install
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
 COPY frontend/ ./
 RUN npm run build
 
@@ -12,6 +12,7 @@ ARG GEOINTEL_INSTALL_AI=false
 ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
 ARG GEOINTEL_TORCH_VERSION=2.13.0
 ARG GEOINTEL_TORCHVISION_VERSION=0.28.0
+ARG GEOINTEL_ULTRALYTICS_VERSION=8.4.99
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
@@ -48,20 +49,21 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 WORKDIR /app
 
 COPY backend/pyproject.toml /app/
+COPY backend/requirements-runtime.lock /app/
 COPY backend/app/__init__.py /app/app/__init__.py
 
 RUN printf '# GeoIntel backend package metadata\n' > /app/README.md \
     && /usr/bin/python3.11 -m venv /opt/geointel/venv \
-    && pip install --no-cache-dir --upgrade pip setuptools \
+    && pip install --no-cache-dir --require-hashes -r requirements-runtime.lock \
     && if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then \
          pip install --no-cache-dir \
            --index-url "$GEOINTEL_TORCH_INDEX_URL" \
            "torch==$GEOINTEL_TORCH_VERSION" \
-           "torchvision==$GEOINTEL_TORCHVISION_VERSION"; \
+           "torchvision==$GEOINTEL_TORCHVISION_VERSION" \
+         && pip install --no-cache-dir \
+           "ultralytics==$GEOINTEL_ULTRALYTICS_VERSION"; \
        fi \
-    && extras=".[gis]" \
-    && if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then extras=".[gis,ai]"; fi \
-    && pip install --no-cache-dir "$extras"
+    && pip check
 
 COPY backend/ /app/
 COPY fixtures/ /app/fixtures/