sm-joe/enterprise-hardened-images ? reverse-engineered prompt

Build me a set of enterprise hardened container images with a common secure baseline, starting from Debian 13 and including Python 3.13, Node.js 22, Java 21, and Nginx 1.28.

I want them to run as a non root user by default, keep the images minimal, remove unnecessary privileges, and be safe to use with a read only root filesystem and dropped capabilities. Please include security checks so the images are tested for basic runtime behavior, secret leaks, and common hardening issues, and make sure critical vulnerabilities are blocked while high ones are governed.

Also set it up so each release includes SBOM and provenance, is signed with Cosign, and builds for both amd64 and arm64. If you need to look up current docs online while wiring things together, do that. Keep the whole thing practical and ready for application teams to consume as a reusable secure base.