feature/GH-14-distroless-debian13
develop
debian12 ships libssl3 3.0.18 with open HIGH/CRITICAL CVEs that fail the Trivy gate; debian13 scans clean. Closes #14