docs(pro): document how to get and enable the FIPS images

[devGregA]

Description

The FIPS 140-3 page told readers to email for access to the FIPS images, and its Docker Compose steps referenced a DD_IMAGE_TAG variable and an x-psirt-vars block that the deployment files do not have. This replaces both with how the images are actually obtained and enabled.

fips_mode.md

• New "Getting the FIPS images" section: every image with a FIPS variant is published as <version>-fips next to its standard image, from 3.3.200. The registry credentials in the license pull them, with nothing to request. It lists the six image references, and notes that the images are linux/amd64 only and signed with SBOM attestations.
• Coverage table: removes the PSIRT advisory engine row (the sidecar no longer ships) and adds the OSCAL validator, which the Helm chart already refuses to render alongside fips.enabled.
• Kubernetes tab: states the 3.3.200 minimum.
• Compose tab, rewritten: from 3.3.300 a single DD_FIPS_MODE variable, set with dojo-compose-cli environment add, selects the -fips images and turns on enforcement, and it persists across upgrades. There is a short note on how to do it by hand on 3.3.200, and why those edits don't survive an upgrade.

fips_on_ecs_fargate.md

• Says where the two images come from, and how to copy them into ECR.
• Drops psirt from the DD_FIPS_MODE list and removes the PSIRT_ENABLED variable, which the nginx entrypoint no longer reads.

Translations (de, es, fr, it, ja, pt-br, zh-hans): the same corrections, applied to their existing structure. The new section uses an explicit {#getting-the-fips-images} heading ID, so the anchor resolves in every language.

The Compose instructions depend on the deployment-file change shipping in 3.3.300, so this should merge once that release is out.

Test results

Built the site locally with the production config (hugo --minify --gc --config config/production/hugo.toml): clean build. Confirmed in the rendered HTML that #getting-the-fips-images and #guard-rails exist on every language's page, that #coverage, #deployment-notes and #enabling-fips-mode exist on the English page, and that the ECS page's #authenticate-to-the-registry target exists on the Kubernetes upgrade page. No page still mentions the old contact address.

🤖 Generated with Claude Code