Fix CVE-2026-42246: upgrade Ruby net-imap gem to >=0.6.4

Applies the established gem-fixup pattern to net-imap in the assemble,
phylo, and mega images. The gem enters via mummer4 -> yaggo -> ruby
(same chain that introduced the json and erb CVEs). Practical
exploitability is near-zero (no IMAP connections are made), but the
Rego policy correctly surfaces it due to AV:N + VC:H + VI:H.

Closes #1065

Author: dpark01

docker/Dockerfile.assemble

@@ -34,6 +34,8 @@ COPY docker/install-conda-deps.sh /tmp/
 #     has CVE-2026-33210; remove the old default gem and install patched version (>=2.19.2)
 #   - Ruby erb gem: same chain (mummer4 → yaggo → ruby), CVE-2026-41316 (Marshal
 #     deserialization bypass via ERB#def_module); remove default gem and install >=6.0.4
+#   - Ruby net-imap gem: same chain (mummer4 → yaggo → ruby), CVE-2026-42246 (STARTTLS
+#     stripping via invalid response timing); remove default gem and install >=0.6.4
 RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements/core.txt /tmp/requirements/assemble.txt \
     --x86-only:/tmp/requirements/assemble-x86.txt && \
     rm -f /opt/conda/libexec/mafft/dash_client && \
@@ -42,7 +44,10 @@ RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements
     gem install json --version '>=2.19.2' --no-document && \
     find /opt/conda/lib/ruby -maxdepth 3 -name 'erb*' -exec rm -rf {} + && \
     rm -f /opt/conda/lib/ruby/gems/*/specifications/default/erb-*.gemspec && \
-    gem install erb --version '>=6.0.4' --no-document
+    gem install erb --version '>=6.0.4' --no-document && \
+    find /opt/conda/lib/ruby -maxdepth 3 -name 'net-imap*' -exec rm -rf {} + && \
+    rm -f /opt/conda/lib/ruby/gems/*/specifications/default/net-imap-*.gemspec && \
+    gem install net-imap --version '>=0.6.4' --no-document
 
 # Copy source code (includes assembly module)
 COPY src/ /opt/viral-ngs/source/src/

docker/Dockerfile.mega

@@ -31,6 +31,8 @@ COPY docker/install-conda-deps.sh /tmp/
 #     remove the old default gem and install patched version (>=2.19.2)
 #   - Ruby erb gem: same chain (mummer4 → yaggo → ruby), CVE-2026-41316 (Marshal
 #     deserialization bypass via ERB#def_module); remove default gem and install >=6.0.4
+#   - Ruby net-imap gem: same chain (mummer4 → yaggo → ruby), CVE-2026-42246 (STARTTLS
+#     stripping via invalid response timing); remove default gem and install >=0.6.4
 RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements/core.txt /tmp/requirements/assemble.txt /tmp/requirements/classify.txt /tmp/requirements/phylo.txt \
     --x86-only:/tmp/requirements/assemble-x86.txt \
     --x86-only:/tmp/requirements/classify-x86.txt \
@@ -41,7 +43,10 @@ RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements
     gem install json --version '>=2.19.2' --no-document && \
     find /opt/conda/lib/ruby -maxdepth 3 -name 'erb*' -exec rm -rf {} + && \
     rm -f /opt/conda/lib/ruby/gems/*/specifications/default/erb-*.gemspec && \
-    gem install erb --version '>=6.0.4' --no-document
+    gem install erb --version '>=6.0.4' --no-document && \
+    find /opt/conda/lib/ruby -maxdepth 3 -name 'net-imap*' -exec rm -rf {} + && \
+    rm -f /opt/conda/lib/ruby/gems/*/specifications/default/net-imap-*.gemspec && \
+    gem install net-imap --version '>=0.6.4' --no-document
 
 # Copy source code (includes all modules)
 COPY src/ /opt/viral-ngs/source/src/

docker/Dockerfile.phylo

@@ -31,6 +31,8 @@ COPY docker/install-conda-deps.sh /tmp/
 #     CVE-2026-33210; remove the old default gem and install patched version (>=2.19.2)
 #   - Ruby erb gem: same chain (mummer4 → yaggo → ruby), CVE-2026-41316 (Marshal
 #     deserialization bypass via ERB#def_module); remove default gem and install >=6.0.4
+#   - Ruby net-imap gem: same chain (mummer4 → yaggo → ruby), CVE-2026-42246 (STARTTLS
+#     stripping via invalid response timing); remove default gem and install >=0.6.4
 RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements/core.txt /tmp/requirements/phylo.txt \
     --x86-only:/tmp/requirements/phylo-x86.txt && \
     rm -f /opt/conda/libexec/mafft/dash_client && \
@@ -39,7 +41,10 @@ RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements
     gem install json --version '>=2.19.2' --no-document && \
     find /opt/conda/lib/ruby -maxdepth 3 -name 'erb*' -exec rm -rf {} + && \
     rm -f /opt/conda/lib/ruby/gems/*/specifications/default/erb-*.gemspec && \
-    gem install erb --version '>=6.0.4' --no-document
+    gem install erb --version '>=6.0.4' --no-document && \
+    find /opt/conda/lib/ruby -maxdepth 3 -name 'net-imap*' -exec rm -rf {} + && \
+    rm -f /opt/conda/lib/ruby/gems/*/specifications/default/net-imap-*.gemspec && \
+    gem install net-imap --version '>=0.6.4' --no-document
 
 # Copy source code (includes phylo module)
 COPY src/ /opt/viral-ngs/source/src/