Security: harden container image and address high-score vulnerabilities

[LordOverlord]

Summary

This PR hardens the Docker image build to mitigate high-severity vulnerabilities (including runc-related findings), reduces image surface area, and ensures the container binary reports consistent version/build metadata.

---

What changed

• Image hardening / CVE mitigation

  • Reworked the container build to reduce exposure to high-score vulnerabilities flagged by scanners (incl. runc-related findings).
  • Removed/avoided unnecessary components to minimize attack surface.

• Dockerfile cleanup

  • Simplified the build stages and final image contents.
  • Ensured the final image contains only the required ctop binary and minimal runtime config.

• Version/build metadata inside the container

  • Build now embeds semantic version and git SHA into the binary used in the container (same fields reported by ctop -v).

---

Why

Security scanners were reporting high-severity vulnerabilities on the image build chain.
This change reduces the image footprint and improves traceability of shipped artifacts via embedded version/build metadata.

---

How to validate

• Build the image locally:

  docker build -t ctop .

• Run version output from the container:

  docker run --rm ctop -v

• Expected: version + build SHA are present.

---

Notes

• This PR intentionally does not include CI/CD workflow changes (upstream may have different pipelines).
• No functional runtime behavior changes beyond build metadata and container hardening.