Having spoken with Gorkem, Roland, and my own internet searches, I'm failing to find a reason why our images contain kernel-headers.

The only possible reason could be if we want to support compilation of sources against the kernel (eg., to build kernel mods?) and thus MAYBE we need these for the c/c++ stack. But probably not for the other ones.

Thus to save us some pain around CVE warnings in code that's not even used in the stacks, we should ensure that kernel-headers are removed from the 1.2.2 and 2.0 images.