fix: clear stale APT lists before apt-get update in Dockerfiles

Kaniko's layer extraction can leave base-image APT metadata with
expired GPG signatures, causing "invalid signature" failures during
apt-get update in CI builds. Adding rm -rf /var/lib/apt/lists/*
before apt-get update ensures a clean state.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/Dockerfile

@@ -61,7 +61,11 @@ FROM node:24-slim AS production
 RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Install dumb-init for proper signal handling
-RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \
+# Clear stale APT lists first — Kaniko's layer extraction can leave
+# base-image metadata with expired GPG signatures (bookworm InRelease).
+RUN rm -rf /var/lib/apt/lists/* \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends dumb-init \
     && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user

apps/coordinator/Dockerfile

@@ -4,9 +4,11 @@ FROM python:3.11-slim AS builder
 WORKDIR /app
 
 # Install build dependencies
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-    build-essential \
+# Clear stale APT lists first — Kaniko's layer extraction can leave
+# base-image metadata with expired GPG signatures (bookworm InRelease).
+RUN rm -rf /var/lib/apt/lists/* \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends build-essential \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy dependency files and private registry config

apps/orchestrator/Dockerfile

@@ -73,7 +73,11 @@ LABEL org.opencontainers.image.description="Agent orchestration service for Mosa
 RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Install wget and dumb-init
-RUN apt-get update && apt-get install -y --no-install-recommends wget dumb-init \
+# Clear stale APT lists first — Kaniko's layer extraction can leave
+# base-image metadata with expired GPG signatures (bookworm InRelease).
+RUN rm -rf /var/lib/apt/lists/* \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends wget dumb-init \
     && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user

apps/web/Dockerfile

@@ -86,7 +86,11 @@ RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
 
 # Install dumb-init for proper signal handling
-RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \
+# Clear stale APT lists first — Kaniko's layer extraction can leave
+# base-image metadata with expired GPG signatures (bookworm InRelease).
+RUN rm -rf /var/lib/apt/lists/* \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends dumb-init \
     && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user