runtime image: Debian 13 base + headless-Chromium shared libs (v4)

python3 >= 3.12 is increasingly a hard floor for PyPI packages a connector
pulls (mcp-server-linkedin declares `requires-python >=3.12,<3.15`), and
`install::ensure_installed` runs the deps install as a plain `python3 -m pip`,
so the system interpreter is what every python connector builds against.
Trixie ships 3.13; it also moves node 18 -> 20 and tesseract 5.3 -> 5.5.

Adds the shared libraries a headless Chromium links against, for connectors
driving a real browser. Libs only — the browser binary is not baked in, the
connector downloads its own pinned build under its connector dir. That split
is the point: a pip/npm install can fetch a binary but cannot supply system
libs, so these are the genuinely non-self-recoverable half. The list is
patchright's own nativeDeps table for debian13; the `t64` suffixes are Debian
13's 64-bit time_t transition and are not optional.

IMAGE_TAG -> v4 so existing containers are recreated, not just new ones.

crates/skald-core/src/container/mod.rs

@@ -37,9 +37,11 @@ use crate::tools::fs as fs_tools;
 /// suffix is the image cache-buster: [`ContainerManager::ensure_image`] rebuilds only
 /// when the tag is absent, so **bump it whenever the [`Dockerfile`] changes** (`v2`
 /// added `sudo` + a NOPASSWD sudoers for the non-root container user; `v3` added
-/// `unzip` + `ffmpeg`). Old tags linger as orphaned images (harmless), but existing
-/// containers still *run* one — which is why [`reusable`] also compares the image.
-const IMAGE_TAG: &str = "skald-runtime:v3";
+/// `unzip` + `ffmpeg`; `v4` moved the base to Debian 13 for python3 >= 3.12 and
+/// added the headless-Chromium shared libs). Old tags linger as orphaned images
+/// (harmless), but existing containers still *run* one — which is why [`reusable`]
+/// also compares the image.
+const IMAGE_TAG: &str = "skald-runtime:v4";
 
 /// The embedded Dockerfile — the source of truth, so the image can be built with
 /// no files shipped alongside the binary (binary-first).