chore: update Dockerfile and CI configuration to use --uploaded-prior-to P30D for pip installs

[fukusuket]

No description provided.

[Copilot]

Pull request overview

This PR hardens container/CI dependency installation by adding additional build configuration for Superset helper services and introducing an “only accept packages older than N days” constraint for Python installs.

Changes:

• Add build: (with CA cert build arg passthrough) to superset-init and superset-resync in Docker Compose.
• Add --uploaded-prior-to P30D to pip installs in Dockerfiles and CI, and pin duckdb-engine for the Superset image.
• Extend frontend .npmrc with min-release-age=7.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
docker/docker-compose.yml	Builds superset-init/superset-resync with the same CA-cert build args as the main Superset service.
dashboard/Dockerfile	Pins duckdb-engine to 0.14.0 for Superset’s uv-managed venv.
config_viz/frontend/.npmrc	Adds min-release-age=7 to the npm configuration.
config_viz/Dockerfile	Adds --uploaded-prior-to P30D to backend dependency installation during image build.
agent/Dockerfile	Adds --uploaded-prior-to P30D to dependency installation during image build.
.github/workflows/ci.yml	Adds --uploaded-prior-to P30D to pip installs in CI steps.