Remediate RC6 container scan findings

backend/tests/test_rc6_supply_chain.py

@@ -101,4 +101,18 @@ def test_release_image_uses_locked_non_ai_dependencies_and_npm_ci() -> None:
     assert "pip install --no-cache-dir --require-hashes -r requirements-runtime.lock" in dockerfile
     assert "ARG GEOINTEL_ULTRALYTICS_VERSION=8.4.99" in dockerfile
     assert '"ultralytics==$GEOINTEL_ULTRALYTICS_VERSION"' in dockerfile
+    assert "ARG GEOINTEL_SETUPTOOLS_VERSION=83.0.0" in dockerfile
+    assert "ARG GEOINTEL_WHEEL_VERSION=0.47.0" in dockerfile
+    assert "COPY deploy/unraid/gosu-setpriv /usr/local/bin/gosu" in dockerfile
     assert "&& pip check" in dockerfile
+
+
+def test_gosu_compatibility_wrapper_uses_exec_and_setpriv() -> None:
+    wrapper = read("deploy/unraid/gosu-setpriv")
+    readiness = read("scripts/run_readiness_check.sh")
+
+    assert "exec setpriv" in wrapper
+    assert '--reuid="$target_user"' in wrapper
+    assert '--regid="$target_user"' in wrapper
+    assert "--init-groups" in wrapper
+    assert "bash -n deploy/unraid/gosu-setpriv" in readiness