fix: pin python base image to bookworm for reproducible builds

Pin to python:3.12-slim-bookworm to prevent silent OS upgrade
when Debian Trixie becomes the default slim tag.

Confidence: high
Scope-risk: narrow

Author: jesseturner21

src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap

@@ -1,7 +1,7 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
 exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = `
-"FROM public.ecr.aws/docker/library/python:3.12-slim
+"FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm
 
 RUN pip install --no-cache-dir uv==0.11.14
 
@@ -41,7 +41,7 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"]
 `;
 
 exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = `
-"FROM public.ecr.aws/docker/library/python:3.12-slim
+"FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm
 
 RUN pip install --no-cache-dir uv==0.11.14
 

src/assets/container/python/Dockerfile

@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/python:3.12-slim
+FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm
 
 RUN pip install --no-cache-dir uv==0.11.14
 

src/cli/commands/import/actions.ts

@@ -383,7 +383,7 @@ export async function handleImport(options: ImportOptions): Promise<ImportResult
               fs.writeFileSync(
                 destDockerfile,
                 [
-                  'FROM public.ecr.aws/docker/library/python:3.12-slim',
+                  'FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm',
                   'RUN pip install --no-cache-dir uv==0.11.14',
                   'WORKDIR /app',
                   '',