ci: validate Docker base image compatibility

[djwhitt]

Summary

• add a Python tool that keeps Dockerfile Elixir, OTP, Rust, and Debian pins synchronized
• query Docker Hub for Debian and Hex builder tags that both support amd64 and arm64
• report base-image age and the latest compatible Debian snapshot
• safely update all three Dockerfiles together with rollback on write failure
• run compatibility checks in Docker PR, production, and daily base workflows

Validation

• 10 focused Python tests pass
• live Docker Hub validation found the current images for amd64/arm64
• live discovery identified trixie-20260610-slim as the latest compatible snapshot
• actionlint passes after excluding the repository's custom Blacksmith runner-label diagnostic
• production Docker workflow passed (run 31847054018)

Stack

• Depends on build: cache native release compilation #3832
• This is security stack PR 1 of 4