A team's Go service Dockerfile uses a single FROM golang:1.22 base. Image size is 1.3 GB and Trivy reports 200+ CVEs in the toolchain. The team is asked to fix this with the smallest workflow change. Which approach achieves the largest reduction in attack surface and CVE count with minimal disruption?
