Builder uses golang:1.23-bookworm (matches runner-base:go-ci). Runtime is debian:bookworm-slim with ffmpeg (server spec §3) plus a non-root minstrel user. Release workflow builds from this Dockerfile.
