fix(cannon): install just from releases in Dockerfile.diff

[ajsutton]

Summary

• The cannon-stf-verify CI job fails because cannon/Dockerfile.diff installs just from Alpine packages (v1.37.0), but justfiles in the repo use the [script('bash')] attribute which requires just >= 1.38.0.
• Replace the Alpine just package with a direct install from GitHub releases, pinned to v1.46.0 to match mise.toml.
• Fixes the regression introduced in chore(cannon): migrate testdata Makefiles to justfiles #19483.

Test plan

• cannon-stf-verify CI job passes with the updated Dockerfile

🤖 Generated with Claude Code

[wiz-inc-a178a98b5d]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	-
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.4%. Comparing base (681867a) to head (4fcf748).
⚠️ Report is 2 commits behind head on develop.

❗ There is a different number of reports uploaded between BASE (681867a) and HEAD (4fcf748). Click for more details.

HEAD has 19 uploads less than BASE

Flag	BASE (681867a)	HEAD (4fcf748)
cannon-go-tests-64	2	1
contracts-bedrock-tests	16	0
unit	2	0

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #19521      +/-   ##
===========================================
- Coverage     75.6%    66.4%    -9.3%     
===========================================
  Files          675       55     -620     
  Lines        71437     4030   -67407     
===========================================
- Hits         54033     2677   -51356     
+ Misses       17260     1209   -16051     
  Partials       144      144              

Flag	Coverage Δ
cannon-go-tests-64	66.4% <ø> (ø)
contracts-bedrock-tests	?
unit	?

Flags with carried forward coverage won't be shown. Click here to find out more.
see 620 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.