chore(deps): bump Python 3.14.2 to 3.14.8

.python-version

@@ -1 +1 @@
-3.14.2
+3.14.8

CHANGELOG.md

@@ -11,6 +11,8 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `TASK_ATTEMPT`, the 0-based number of the task's attempt, which the executor
   sets on every production Job. The harness does not read it; a node script
   may. Documentation only: no package changes.
+- The engine images build on `python:3.14.8-slim` (was `3.14.2`), and
+  `.python-version` and the `template/` Dockerfile follow.
 
 ## [0.10.0] - 2026-10-22
 

Dockerfile.duckdb

@@ -1,4 +1,4 @@
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 # One dual-role image per engine: the python-node runtime harness (default
 # command `run`) and the blue/green validation runner (`validation-op`). It
 # installs the PUBLISHED, versioned libraries, never the repo source:

Dockerfile.postgres

@@ -1,4 +1,4 @@
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 # One dual-role image per engine — the python-node runtime harness (default
 # command `run`) and the blue/green validation runner (`validation-op`). It
 # installs the PUBLISHED, versioned libraries, never the repo source:

Dockerfile.trino

@@ -1,4 +1,4 @@
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 # One dual-role image per engine — the python-node runtime harness (default
 # command `run`) and the blue/green validation runner (`validation-op`). It
 # installs the PUBLISHED, versioned libraries, never the repo source:

template/Dockerfile.pip

@@ -3,7 +3,7 @@
 # requirements file (regenerate with the command in template/README.md).
 # Shape 1 (FROM the engine image, see template/Dockerfile) is simpler; use this
 # only when you must control the base image.
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 COPY requirements.lock /tmp/requirements.lock
 RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements.lock \
     && rm -f /tmp/requirements.lock

template/README.md

@@ -52,7 +52,7 @@ any extra dependency your script needs). Pin by tag or digest
 specific reason not to.
 
 **Shape 2 — `Dockerfile.pip`, your own base (hash-locked).** Builds
-`FROM python:3.14.2-slim` (or another base you control) and installs
+`FROM python:3.14.8-slim` (or another base you control) and installs
 `continuo-python-runtime` plus one `continuo-<engine>-adapter` from PyPI via
 `pip install --require-hashes -r requirements.lock`. Use this when you must
 control the base image yourself — e.g. your org mandates a specific base,