docs: update Docker base image versioning documentation (Phase 5)

- Dockerfile.unified: Document ubuntu:latest strategy (cross-platform LTS)
- Dockerfile.ethics-ai: Document python:3.11-slim strategy (auto-patch within 3.11.x)
- docker/README.md: Add 'Base Image Versioning Strategy' section with rationale
- DOCKER_BUILD_STRATEGY_QUICKREF.md: Add strategy matrix and cross-compilation benefits
- Validate: All 47 workflows pass YAML syntax validation

Rationale:
- ubuntu:latest allows independent registry resolution (no SHA divergence)
- LTS patches applied automatically across Docker registries
- Reduces maintenance of minor version pinning
- Improves cross-compilation resilience (Docker/Linux/macOS/Windows)

Co-authored-by: makr-code <150588092+makr-code@users.noreply.github.com>

Author: Copilot

docker/DOCKER_BUILD_STRATEGY_QUICKREF.md

@@ -1,6 +1,6 @@
 # Docker Build Strategy Quick Reference
 
-**Status:** current as of 2026-08-22  
+**Status:** current as of 2026-09-01  
 **Canonical build entrypoint:** [../Dockerfile](../Dockerfile)  
 **Supporting assets:** [../docker](../docker)
 
@@ -12,6 +12,22 @@
 - BuildKit cache mounts are used for APT package caches and vcpkg caches.
 - The vcpkg clone step is guarded so a cached build directory does not fail with “destination path ... already exists and is not an empty directory”.
 
+## Base Image Versioning (as of 2026-09-01)
+
+**Primary strategy:** Use floating/latest tags for cross-platform compatibility
+
+| Dockerfile | Base Image | Policy | Rationale |
+|---|---|---|---|
+| `Dockerfile.unified` (Primary) | `ubuntu:latest` | Always track LTS + patches | Auto-resolves across registries; no SHA divergence |
+| `Dockerfile.ethics-ai` | `python:3.11-slim` | Track Python 3.11.x patches | Allows security patches; platform-independent resolution |
+| `Dockerfile.themisdb` (Legacy) | `ubuntu:22.04` | Deprecated; not updated | For backward compatibility only |
+
+**Benefits:**
+- Different Docker registries (Linux/macOS/Windows/Docker Desktop) independently resolve `ubuntu:latest` without SHA conflicts
+- All LTS security patches are applied automatically
+- Reduces maintenance burden of tracking minor versions
+- Improves cross-compilation resilience
+
 ## Why this layout
 
 This repository uses a single root Dockerfile so the build is consistent for:

docker/README.md

@@ -15,13 +15,35 @@ The supporting files in this directory are deployment/configuration helpers and
 - runtime and compose support for development/test workflows
 - edition-specific support files under [community](community), [enterprise](enterprise), and [hyperscaler](hyperscaler)
 
+## Base Image Versioning Strategy
+
+### Primary Dockerfile (Dockerfile.unified)
+
+- **Base image:** `ubuntu:latest`
+- **Rationale:** Ubuntu's `latest` tag automatically tracks the current LTS release with security patches
+- **Benefit for cross-compilation:** Different Docker registries (Linux/macOS/Windows) can independently resolve `ubuntu:latest` without SHA divergence
+- **Security:** All LTS patches are applied automatically; no need to manually track minor versions
+
+### Ethics AI Dockerfile (Dockerfile.ethics-ai)
+
+- **Base image:** `python:3.11-slim`
+- **Rationale:** Python slim images receive regular patch updates within the major.minor version
+- **Benefit for cross-compilation:** Allows automatic Python 3.11.x security patches across platforms
+- **Note:** `-slim` is preferred over `-slim-bookworm` to allow flexibility in underlying Debian version
+
+### Legacy Dockerfile (Dockerfile.themisdb)
+
+- **Status:** Deprecated
+- **Migration path:** Use `Dockerfile.unified` for new builds
+- **Note:** Not updated with `ubuntu:latest`; kept for historical compatibility only
+
 ## Local build
 
 From the repository root:
 
 ```bash
 docker buildx build --progress=plain --load \
-  -f Dockerfile \
+  -f docker/Dockerfile.unified \
   -t themisdb:test \
   --build-arg THEMIS_EDITION=COMMUNITY \
   --build-arg ENABLE_LLM=OFF \