fix(zotero): reinstall yq as static binary so KasmVNC entrypoint isn't FATAL

The CVE-hardening pass purged yq (vulnerable Go stdlib in the base copy),
but kasmvnc-entrypoint.sh hard-depends on it to render kasmvnc.yaml. With
yq gone, the kasmvnc supervisor program went FATAL on every fresh
container, leaving a blank :21 desktop that container/nginx/Xvnc liveness
all miss.

Reinstall yq (mikefarah v4) as a current static binary after the purge —
a recent release carries the patched Go stdlib that motivated the removal.
yq is only needed at container runtime, so purge-then-reinstall ordering
is safe; `yq --version` validates the download at build time.

infra/images/zotero.Dockerfile

@@ -6,7 +6,10 @@ USER root
 # Security patches: upgrade all OS packages + remove vulnerable binaries
 # we don't need in a Zotero-only container.
 #   ipp-usb  — IPP-over-USB printer daemon (Go stdlib CVEs)
-#   yq       — YAML processor (Go stdlib CVEs)
+#   yq       — vulnerable base copy removed here, then REPLACED below with a
+#              current static binary. kasmvnc-entrypoint.sh requires yq to
+#              render kasmvnc.yaml; purging it outright left the kasmvnc
+#              supervisor program FATAL on every fresh container (blank :21).
 #   firefox  — base image browser; Zotero ships its own (expat CVEs)
 RUN apt-get update \
     && apt-get upgrade -y \
@@ -23,6 +26,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         zotero \
     && rm -rf /var/lib/apt/lists/*
 
+# Reinstall yq as a current static binary (replaces the vulnerable base copy
+# purged above). KasmVNC's entrypoint hard-depends on it (mikefarah v4 syntax);
+# a recent release carries the patched Go stdlib that motivated the removal.
+ARG YQ_VERSION=4.53.3
+RUN arch="$(dpkg --print-architecture)" \
+    && curl -fsSL "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${arch}" -o /usr/bin/yq \
+    && chmod +x /usr/bin/yq \
+    && yq --version
+
 # Patch Python packages with known CVEs from base image
 RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1"