chore: Debian 12 → 13 (Trixie) migration, service hardening

- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie)
- Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime
  in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no)
- Update GLIBC compatibility checks from 2.36 to 2.40
- ISO filename, build container, and docs updated throughout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/README.md

@@ -35,7 +35,7 @@ See the Architecture documentation for detailed system information.
 
 ## What's Included
 
-- **Debian Linux Base**: Stable Debian 12 (Bookworm) distribution
+- **Debian Linux Base**: Stable Debian 13 (Trixie) distribution
 - **Podman**: Container runtime for apps (rootless by default)
 - **Archipelago Backend**: Rust-based API server
 - **Archipelago Frontend**: Vue.js web interface
@@ -44,7 +44,7 @@ See the Architecture documentation for detailed system information.
 
 ## Build Output
 
-- `results/archipelago-debian-12-x86_64.iso` - Bootable hybrid ISO image
+- `results/archipelago-debian-13-x86_64.iso` - Bootable hybrid ISO image
 
 ## Supported Platforms