chore: Debian 12 → 13 (Trixie) migration, service hardening

- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie)
- Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime
  in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no)
- Update GLIBC compatibility checks from 2.36 to 2.40
- ISO filename, build container, and docs updated throughout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/build-iso-dev.yml

@@ -50,8 +50,8 @@ jobs:
           # Build in persistent repo dir to reuse target/ cache
           cd "$HOME/archy"
           export GIT_HASH=$(git rev-parse --short HEAD)
-          # Static musl build — runner is Debian 13 (glibc 2.41) but ISO rootfs
-          # is Debian 12/bookworm (glibc 2.36). Dynamic binary won't run.
+          # Static musl build for portability — ensures binary runs regardless
+          # of glibc version differences between build host and ISO rootfs.
           cargo build --release --target x86_64-unknown-linux-musl --manifest-path core/Cargo.toml
           # Copy binary to workspace for downstream steps
           mkdir -p "$GITHUB_WORKSPACE/core/target/release"