Keep dependency resolution tied to the authenticated indexes in the official image. Current KDE Release metadata returns 502/504 while indexed package downloads work. Fresh-container dependency installation, strict make check with no skips, and make package all pass. Update contributor documentation and Unreleased; applet behavior and TODO are unchanged.