Security: Pin dependency versions in Dockerfile #7

Version Pinning (Security & Reproducibility)

• Pin Node.js version (avoid curl setup_lts.x)
• Pin ttyd version (do not use /latest/)
• Pin Copilot CLI version
• Pin @anthropic-ai/claude-code version
• Pin all apt-get package versions (use package=version format) - DL3008
• Pin all npm package versions (use package@version format) - DL3016

Shell Best Practices

• Set SHELL option -o pipefail before RUN commands with pipes - DL4006
• Quote commands properly to prevent word splitting - SC2046
• Fix mkdir -p with -m flag issue (SC2174) - when used with -p, -m only applies to deepest directory

Optimization & Security

• Add --no-install-recommends flag to apt-get install commands - DL3015
• Standardize on either wget or curl, not both - DL4001

Documentation

• Document all pinned versions and rationale
• Add comments explaining version choices

These changes improve security, reproducibility, and follow Dockerfile best practices identified by hadolint.