Evaluate and pin the production Debian base image

[DenWin]

Goal

Replace the rolling Debian testing base with the most suitable reproducible production base.

Current evidence

Debian 13 Trixie is the current stable release. A simulated installation of the complete ConvertX APT package list succeeds on debian:trixie-slim, including ImageMagick 7, Calibre, LibreOffice, resvg, dasel, and the TeX packages.

Package availability alone does not prove converter compatibility.

Proposed work

• Build the full image with debian:trixie-slim.
• Run the converter smoke-test matrix.
• Test linux/amd64 and linux/arm64.
• Compare installed size, build time, and vulnerability reports with testing-slim.
• Select an immutable image digest.
• Configure automated digest updates, preferably through Renovate.
• Document the base-image selection and update policy.

Acceptance criteria

• All supported converter families pass representative tests.
• Both supported architectures build successfully.
• The production image uses a named stable Debian release.
• The image digest and its update mechanism are documented.