fix(cv): isolate document parsing

Run untrusted document decoders in a secret-free, resource-bounded child process and terminate its process tree on deadline. Harden the production container and enforce parser and lint gates in CI.
2026-08-30 11:12:25 +02:00
parent a8bf505ce5
commit 19c5251612
13 changed files with 677 additions and 176 deletions
@@ -1,3 +1,3 @@
 -r requirements.txt
 pytest==8.3.5
-httpx==0.28.1
+httpx2==2.12.0