docker: bump postgres from 18.4-alpine to 18.4-alpine

[dependabot]

Bumps postgres from 18.4-alpine to 18.4-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• postgres:18.4-alpine digest: sha256:1b1689… → sha256:9a8afc…
• Reviewed head: b1cd1ab087bd67eb74f4abe9febe4b025873da9a

Security review

• Confirmed security rebuild: Alpine curl/libcurl advances from 8.20.0-r1 to 8.21.0-r0, fixing 18 CVEs listed by Alpine; util-linux/libuuid also advances from 2.42-r0 to 2.42.1-r0.
• PostgreSQL remains 18.4 with the same source SHA and identical amd64 postgres binary SHA-256.
• All eight Docker Official Images platforms retain the same architecture set, nine-layer structure, Alpine base digest, runtime configuration, entrypoint, command, port, volume, and PGDATA.
• The only source behavior change unsets POSTGRES_* bootstrap credentials before the final PostgreSQL exec, after initialization scripts complete. This reduces credential exposure without changing River's database initialization.
• SLSA provenance traces to GitHub-verified Docker Library source and publication commits. No unexpected package, capability, hook, platform, or binary change was found.

Compatibility verification

• docker compose -f docker-compose.dev.yaml config --quiet — passed.
• git diff --check — passed.
• make test — passed across the root, Pro, and packager modules.
• Required Go/JS CI and both public riverui architecture image builds passed.
• The riverproui job fails before build because Dependabot cannot assume the AWS OIDC role; it is not an image or dependency failure.

Residual risk

• A local Docker daemon was unavailable, so the exact PostgreSQL digest could not be pulled and the fresh-volume initialization/migration flow was not executed locally.
• Only the amd64 SPDX filesystem was deeply compared; SLSA declares reproducible: false. No blocking issue was identified.