feat(base): add reproducible Debian package projection

[szmyty]

Summary

• project the canonical base profile into a reproducible Debian Trixie image for linux/amd64 and linux/arm64
• pin the Dockerfile frontend, MCR base index and platform manifests, Debian snapshots, signed metadata, and resolver keyring
• commit exact architecture-specific apt locks and verify their semantic relationship to the catalog, profile, configuration, and Dockerfile during builds
• add installed-package provenance, offline verification, non-root smoke tests, refresh/change-report tooling, Task commands, and non-publishing native CI

Scope reconciliation

Issue #1 predates Realm's finalized capability/profile architecture. Its original reproducibility requirements still apply: immutable inputs, exact package locks, deterministic installation, installed-package evidence, refresh tooling, CI validation, and an informational size baseline.

The later architecture decisions define where that machinery belongs:

• issue #2, merged through PR #3, made capability profiles canonical and established separate base, language, full, and services boundaries;
• the issue author's August 19 RLM-01 refinement requests the smallest inheritable multi-platform base and explicitly keeps language toolchains and optional services out;
• ROADMAP REA-Q03 assigns feat(devcontainer): add the reproducible pinned apt development toolchain #1 the deterministic base projection, while REA-Q04 assigns language and full-image projections to Publish curated language and workstation tool profiles #5, Publish the full development profile with an explicit size budget #6, and Integrate Mantle and define container shell activation semantics #8.

Accordingly, this PR projects the merged base = realm-base + common-cli contract onto the repository-selected Debian Trixie base. Debian follows the source and profile policy established by PR #3; it is not a second package policy introduced by the Dockerfile.

The broader toolchain remains explicitly owned:

• Publish curated language and workstation tool profiles #5 owns curated language and workstation-tool profiles.
• Publish the full development profile with an explicit size budget #6 owns the tested full-profile union, its exact delta from base, and enforced size budgets.
• Privileged and service-backed capabilities remain explicit opt-ins through services or consuming orchestration.

This PR establishes and reports the base-size baseline without preempting #6's full-image budgets.

Validation

Completed before push:

• 46 unit and contract tests
• offline apt configuration and lock validation
• amd64 and arm64 replays against their signed snapshots
• pinned OCI index and platform-manifest verification
• same-snapshot refresh with byte-identical locks and an empty classified change report
• Bash syntax, ShellCheck, JSON/YAML parsing, and git diff --check

The pull-request workflow passed on native amd64 and arm64 runners: image builds, exact installed-inventory verification, network-disabled smoke tests, and expanded-size reporting. It has read-only permissions and never publishes an image.

Size baseline

Architecture	Base expanded (bytes)	Result expanded (bytes)	Delta (bytes)
amd64	940,758,919	966,050,411	+25,291,492
arm64	956,844,628	981,430,735	+24,586,107

These are informational expanded-size measurements from the successful native CI run; #6 owns the full-image budget.

Closes #1

Roadmap-Step: REA-Q03

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress