ci: automate Docker base snapshot updates

[djwhitt]

Summary

• update the pinned Debian/Hex builder snapshot from trixie-20260112-slim to the latest compatible trixie-20260610-slim
• add a weekly updater that proposes reviewed base-snapshot PRs
• require matching amd64/arm64 Debian and Hex tags to be published for at least three days
• enforce a 90-day maximum snapshot age while warning after 45 days
• create/reopen update PRs idempotently and explicitly dispatch Docker validation
• keep Elixir, OTP, and Rust toolchain updates deliberate while validating that their Docker and .tool-versions pins stay synchronized

Validation

• updater reports the June snapshot is current, compatible, and 65 days old
• 17 focused Python tests pass across the stack
• full production Docker image build and runtime smoke check pass with the June snapshot
• repository Actions settings permit write-capable GITHUB_TOKEN workflows
• updater has no privileged manual-dispatch path
• production Docker workflow passed with the refreshed base snapshot (run 31848530974)

Stack

• Depends on ci: audit production image vulnerabilities #3834
• This is security stack PR 3 of 4