R-972: the controller runtime on Debian 12.13 (restic stays 0.14.0); Debian 13 is its own change (R-1105)

Debian 13 ships restic 0.18.0; the off-site engine's measured behaviour is 0.14.0's. The binary stays on
Go 1.27.2; the runtime moves to the current Debian 12 point release, pinned by digest.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/Dockerfile

@@ -5,8 +5,8 @@
 # =============================================================================
 
 # --- Build stage ---
-# R-972 (v0.322.0): a supported, patched Go and the current Debian stable, pinned by version AND digest (no moving tag).
-# Go 1.24 had no security fixes left (go.dev/doc/devel/release#policy); bookworm-slim carried 12 fixable criticals.
+# R-972 (v0.322.0): a supported, patched Go, pinned by version AND digest (no moving tag). Go 1.24 had no security fixes
+# left (go.dev/doc/devel/release#policy). The builder's Debian does not reach the runtime (a static CGO-free binary).
 FROM golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e AS builder
 
 ARG TARGETOS=linux
@@ -41,7 +41,11 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
     ./cmd/controller/
 
 # --- Runtime stage ---
-FROM debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+# The runtime stays on Debian 12 (its current point release, 12.13, with every fixed package) ON PURPOSE: Debian 13
+# ships restic 0.18.0, and the off-site engine's measured behaviour is restic 0.14.0's (a missing source path is a
+# warning, the --json progress shape, the forget day-buckets, restore without a lock — offbox_*.go). Moving to
+# Debian 13 is its own change with that re-proof (R-1105). The binary itself is built on Go 1.27.2 above.
+FROM debian:12.13-slim@sha256:67b30a61dc87758f0caf819646104f29ecbda97d920aaf5edc834128ac8493d3
 
 # Install runtime dependencies:
 # - docker-cli: for "docker compose" commands
@@ -81,7 +85,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Install docker-cli (without daemon)
 RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg \
     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] \
-       https://download.docker.com/linux/debian trixie stable" > /etc/apt/sources.list.d/docker.list \
+       https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list \
     && apt-get update \
     && apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin \
     && rm -rf /var/lib/apt/lists/*