Pull the base images fresh on every build (bau-pm BAU-191)

Finding 41 of bau-pm's v0.22.3 security review called this a pin to move.
It is not a pin: both bases here are floating tags, so what ships is
whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while
quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8,
past five October CVEs - none of them reachable in a static file server
configured like this one, which is why --pull is the fix rather than a pin.

The CI build gets it too: a gate running against a months-old cached base
is not testing what the release builds.

A release is what applies this. The running image does not change until one
is cut.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project are documented in this file. The format is b
 
 ## [Unreleased]
 
+### Security
+
+- The CI and release builds pull their base images fresh (`docker build --pull`). Both bases are floating tags, so what shipped was whatever the runner had cached: v0.1.0 went out with nginx 1.31.6 while the tag had already moved to 1.31.8, past five October CVEs. None of the five is reachable in a static file server configured like this one, which is why this is the fix rather than a pin. From bau-pm's v0.22.3 security review, finding 41 (bau-pm BAU-191). **A release is what applies it** - the running image does not change until one is cut.
+
 ## [0.1.0] - 2026-10-10
 
 The first release: BentoPDF v2.8.8 for bau-pm, about 120 PDF tools that run in the browser and talk to no third party, with the hand-off that brings a PDF from bau-pm into a tool and the result back.