Move the whisper and runtime stages from Alpine to debian:bookworm-slim
(glibc), keeping the Go build stage on golang:1.25-alpine since the binary
is CGO_ENABLED=0 static and runs unchanged on the Debian runtime.

- runtime/whisper: apt-get with --no-install-recommends, Debian package
  names (libstdc++6), gh from the official apt repo, useradd for the
  non-root odek user.
- agent toolchains: Python 3 + python3-venv (PEP 668), Go from the
  official tarball, Bun glibc build.
- whisper: add -DGGML_NATIVE=OFF. Debian's GCC 12 fails to inline FP16
  NEON intrinsics (vfmaq_f16, "target specific option mismatch") under
  the default -mcpu=native on arm64. A fixed baseline arch sidesteps it,
  builds on amd64 and arm64, and keeps the image reproducible.

Verified: full image builds; Debian 12 base; odek (static) and
whisper-cli run; gh/git/ffmpeg/python3/go/bun present; runs as odek.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>