fix: move Docker base images to bookworm and pin uv's interpreter

[drkrillo]

Description

Debian 11 (bullseye) reached end of life on Aug 31, so packages from bullseye-security return 404 and the backend image stops building.

This moves both base images to Debian 12 (bookworm) and pins the interpreter uv resolves to.

The pin is needed because of the PATH set a few lines above:

ENV PATH="/usr/bin/:/usr/local/bin:/usr/lib:${PATH}"

/usr/bin comes first. On bullseye the system python3 was 3.9, so it never competed with the 3.11 the image ships in /usr/local/bin. On bookworm the system python3 is 3.11, it satisfies the 3.11 in .python-version, and uv picks it up:

0.101 Using CPython 3.11.2 interpreter at: /usr/bin/python3.11
0.595   × Failed to build `psutil==5.8.0`
0.595       psutil/_psutil_common.c:9:10: fatal error: Python.h: No such file or
0.595       directory

That interpreter has no development headers, and psutil==5.8.0 has no wheel for it, so it builds from source and fails. UV_PYTHON=/usr/local/bin/python3.11 points uv at the interpreter the image already ships.

Verified on linux/amd64, building the image before and after the change:

• before: fails at apt-get install, 33 of 111 packages 404 from debian-security
• after: builds, and the resulting venv uses /usr/local/bin/python3.11 (3.11.16)

arch:            x86_64
venv python:     Python 3.11.16
venv points to:  /usr/local/bin/python3.11
collectoss CLI:  OK

This PR fixes #481

Notes for Reviewers

• The build is fixed by this change, but the end-to-end jobs will still fail. That failure is separate and older: it also happens on main, and the docker workflow has been red since start of August. The job reaches the 8 minute timeout waiting for Querying committers count, which never gets logged because repo_info_model raises on the GraphQL query before reaching it. I'll open a separate issue with the details rather than mix it into this PR.

• I see Fix/upgrade docker base bullseye to bookworm #489 is open for the same issue. I'll close this one if you prefer to go that route. The difference worth a look either way is UV_PYTHON versus installing python3-dev: both make the build pass, but the first points uv at the interpreter the image ships, while the second adds the headers for the Debian one that PATH resolves to first. Pinning keeps the image smaller and makes the interpreter explicit.

Signed commits

• Yes, I signed my commits.

Generative AI disclosure

Please select one option:

• This contribution was NOT assisted or created by Generative AI tools.
• This contribution was assisted or created by Generative AI tools.

If AI tools were used, please provide details below:
- What tools were used? Claude
- How were these tools used? Analysis of the build and CI logs, verification builds on linux/amd64 with the unpatched Dockerfile as a control, and a draft of this description
- Did you review these outputs before submitting this PR? Yes, I found the root cause and verified the fix locally before opening the issue, and I reviewed and edited everything here

[MoralCode]

• I'll open a separate issue with the details rather than mix it into this PR

awesome, thanks so much!

• I see Fix/upgrade docker base bullseye to bookworm #489 is open for the same issue. I'll close this one if you prefer to go that route.

No need, I like your approach better (keeping the images small) - I didn't realize that we had basically two python interpereters in the image

Also id love to invite you to join CHAOSS Slack in the #wg-collectoss-8knot channel - mostly jut cuz im curious how you found CollectOSS/what your interest is in the project (would love to do what I can to help you be successful in your own goals with this project!)