mcore-bump-base-image

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill requires and instructs using the external container image nvcr.io/nvidia/pytorch:<YY.MM>-py3 (e.g., written into docker/.ngc_version.dev and used by docker build / CI), which will be pulled at runtime and thus executes remote code from nvcr.io/nvidia/pytorch, so this is a runtime external dependency.