feat(docker): slim multi-stage image, variant A: base-image python

[jp-fizzbee]

Summary

Variant A of two — see PR for user/jp/feat-docker-hermetic-python (variant B) for the alternative; the two are mutually exclusive, pick one. Both replace the abandoned single-stage image (full bazel/Ubuntu/JDK build env, gigabytes of unpatched CVE surface).

	A (this PR)	B (hermetic)
Parser's python	Base image's (python:3.12-slim) via symlink	rules_python bundled interpreter, as tarballs ship
Size	308MB	525MB
Interpreter CVE patching	docker pull after base rebuild	Only via bazel toolchain pin bump + republish
Risk	Relies on rules_python runfiles layout (unstable interface); mitigated by pre-push smoke tests on both arches	None beyond status quo

Review-feedback changes since the first revision

• \|\| true removed entirely — the rules_python 1.9.2 bump is dropped (see below), so no venv exists; a defensive documented rm -rf guards future bumps.
• rules_python bump withdrawn: 1.9.2's venv-based bootstrap is broken for cross-compiled binaries (stub disables the venv, no baked imports → ModuleNotFoundError at runtime). It would have broken release tarballs for every cross-built platform. Needs separate investigation.
• mbt_gen.zip included — fizz mbt-scaffold works in the container (smoke-tested).
• Builder pinned to gcr.io/bazel-public/bazel:8.3.1.
• Smoke tests expanded: amd64 runs Counter + two-phase-commit (exercises antlr4/protobuf parser surface) + mbt-scaffold; arm64 runs Counter under QEMU before any push. PASSED-grep is the real assertion (binary exits 0 even on FAILED — exit code alone is insufficient by design).
• Post-push manifest verification (both architectures present).
• latest tag policy documented in the workflow header (moves on version tags AND monthly rebuilds).
• Packaging divergence from build_release.sh documented in the Dockerfile header.

Verification

• Local (arm64): image assembled via the exact Dockerfile commands runs two-phase-commit with baseline-identical output (331/281) on the base image's interpreter; scaffold works; relative spec paths work.
• docker scout: only 4 perl CVEs remain — currently unfixed upstream in every Debian release, present in the bare python:slim base too; they clear via the monthly rebuild once Debian ships fixes.
• Builder stage in-container: covered by the workflow's pre-push smoke tests (needs amd64; first workflow_dispatch after merge exercises it).

Post-merge checklist

1. Actions → Docker → Run workflow (no tag needed).
2. Verify smoke tests green; manifest shows both platforms.
3. Make the ghcr package public (first publish defaults to private).

🤖 Generated with Claude Code