Dockerfile Linter — Container Safety Gate

Lint a Dockerfile offline for unpinned or latest base images, RUN lines that pipe a download into a shell, apt-get install without cache cleanup, apt-get update without install in the same layer, ADD used where COPY would do, and images with no USER instruction. Deterministic pass/fail results plus JSON and Markdown reports, without building or pulling any image and without copying instruction bodies into reports.