PG010: Avoid using network tools in the final build stage

Network utilities like curl, wget, and netcat are used in RUN commands of the final build stage. Even when these tools are not explicitly installed (they may come pre-installed in the base image), their presence expands the attack surface of the production container. The CIS Docker Benchmark (Section 4.3) advises against keeping unnecessary packages in containers. Real-world campaigns such as Commando Cat (2024) exploited pre-existing curl and netcat inside containers for payload download and reverse shells. Use a multi-stage build to confine network tool usage to a builder stage, then COPY only the artifacts into a minimal final image.