chore(docker): base image bookworm -> trixie (#374)

Debian 13 (trixie) is current stable; bookworm is oldstable and its
scanner profile will only degrade from here. Same unfixed perl C/H in
both today, but trixie drops the openssl HIGH and roughly halves the
M/L noise (bookworm: 2C 3H 17M 41L -> trixie: 2C 2H 11M 29L).

The python:3.12-slim base itself is unchanged in role: the parser runs
on the tarball's bundled hermetic interpreter; the base only provides
bash for the fizz wrapper and a `python` binary for the mbt-scaffold
launcher — which is also why plain debian:slim doesn't fit (no python
without an apt RUN step, which would break the no-RUN runtime stage
that lets multi-arch builds skip QEMU) and alpine can't work at all
(the bundled interpreter is glibc-linked).

Verified against the real v0.5.3 tarball on trixie: two-phase-commit
passes with baseline-identical output (331/281), and mbt-scaffold —
never previously exercised on trixie — works.

Co-authored-by: jayaprabhakar <jayaprabhakar@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

Dockerfile

@@ -23,7 +23,7 @@
 # `python`; the parser itself uses the tarball's bundled interpreter.
 
 # ---- Fetch ----------------------------------------------------------------
-FROM --platform=$BUILDPLATFORM python:3.12-slim-bookworm AS fetch
+FROM --platform=$BUILDPLATFORM python:3.12-slim-trixie AS fetch
 
 ARG FIZZBEE_VERSION
 ARG TARGETARCH
@@ -52,7 +52,7 @@ RUN set -e; \
     test -x /opt/fizzbee/parser/parser_bin
 
 # ---- Runtime ---------------------------------------------------------------
-FROM python:3.12-slim-bookworm
+FROM python:3.12-slim-trixie
 
 COPY --from=fetch /opt/fizzbee /opt/fizzbee