[austindimmer]

Refreshes every CA store in jenkins-agent-terraform-2306 after the eMudhra/emSign incident (eight compromised intermediate CAs, see https://emudhra.we-have-a-problem.com/ and GHSA-6q48-6c7w-9gw2), and moves Node off the EOL 18 line.

pip always loads the CA certificates from its vendored certifi in addition to the system trust store, so updating the OS ca-certificates alone is not enough.

Changes (common/jenkins-agents/terraform-2306/docker/Dockerfile.ubi9, python_requirements):

• Node.js 18 -> 24 LTS (NodeSource setup_24.x, resolves 24.22.1); nodemon and aws-cdk are unchanged
• uv 0.10.9 -> 0.13.5 (embedded CA store fix, GHSA-hq85-5cpj-mr62)
• pip>=26.2.2 for the uv-managed Python, plus certifi>=2026.10.23
• dnf -y update ca-certificates in the package layer
• Python 3.8 and 3.9 are no longer installed: they are EOL and no pip release with the fix supports them (pip >= 26.1 requires Python >= 3.10). The pip for 3.8 vendors certifi 2024.02.02, which still trusts the AAA cross-signed intermediates. Both can still be installed on demand with uv python install 3.8 / 3.9.
• Behaviour change: python3, python and python3-config are now the uv-managed default Python 3.11 (PYTHON_DEFAULT_VERSION, defined once), with the agent's libraries (boto3, requests, python-hcl2, certifi, ...). Before, python3 was the RHEL platform 3.9, which had those libraries only because uv pip install --system --python 3.9 resolved to it. Without this, scripts calling python3 would have lost them. /usr/bin/python3 stays the platform Python for dnf/yum, which use it through their shebang; the build checks that dnf still works. python3-config is an exec wrapper, because the standalone build's script derives its prefix from its own path.
• The console scripts of the default Python 3.11 (pipenv, virtualenv, az, pre-commit, pycodestyle, ...) are linked into /usr/local/bin, and the build checks them together with python3. pipenv now creates Python 3.11 environments where it used to pick 3.8.
• The Python install loop now fails the build on the first interpreter that fails. Before, fi; let a later successful iteration hide an earlier failure.
• CHANGELOG: the python3/pipenv default under Changed, the CA refresh under Fixed, the Python 3.8/3.9 removal under Removed.
• Docs: Node/Python versions and python3 for 2306 in inf-terraform.adoc.

Verified locally with the CI build command: node v24.22.1; pip 26.2.2 (vendored certifi 2026.10.19) and certifi 2026.10.23 on Python 3.11.17; python3 = 3.11.17 with the libraries; uv 0.13.5; pipenv, virtualenv, az and pre-commit on PATH; pipenv install / pipenv run works; dnf works. No CA store we own trusts the compromised intermediates, checked with the published emSign ECC Root CA - G3 cross-signatures as untrusted chain certificates (an older image of the 2408 agent fails the same check).

Known residuals (not changed here, follow-ups welcome): virtualenv==20.26.3 still seeds pip 24.1 into new virtualenvs (virtualenv >= 21.14.12 embeds pip 26.2.2); pipenv 2023.x, AWS SAM CLI (aws/aws-sam-cli#9359) and some Ruby gems (httpclient, excon, aws-sdk-core, google-api-client) ship their own older CA bundles.

Tasks:

• Updated documentation in docs/modules/... directory
• Ran tests in <quickstarter>/testdata directory (n/a: agent image only; CI job jenkins-agent-terraform-2306-ubi9 builds it)