fix(agent): upgrade libnghttp2-14 (CVE-2026-27135) and clear stale .trivyignore

[scottschreckengaust]

Summary

• Upgrades libnghttp2-14 from 1.64.0-1.1 to 1.64.0-1.1+deb13u1 in the agent Dockerfile, fixing CVE-2026-27135 (HTTP/2 DoS via malformed frames after session termination)
• Removes stale CVE-2026-33671 from .trivyignore — this CVE is no longer detected in the image and was suppressing nothing
• Result: zero HIGH/CRITICAL findings in Trivy with an empty .trivyignore

What changed

File	Change
agent/Dockerfile	Added apt-get upgrade -y --no-install-recommends libnghttp2-14 after system dep install
agent/.trivyignore	Cleared (was CVE-2026-33671, no longer relevant)

Verification

$ trivy image --scanners vuln --ignore-unfixed --severity HIGH,CRITICAL bgagent-trivy-test:latest
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

All scanners report 0 findings. No suppressions needed.

Test plan

• Docker image builds successfully
• Trivy passes with zero HIGH/CRITICAL, no .trivyignore entries
• Pre-commit hooks pass
• CI build (agent quality + image scan)

🤖 Generated with Claude Code