chore: Debian 12 → 13 (Trixie) migration, service hardening

- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie)
- Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime
  in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no)
- Update GLIBC compatibility checks from 2.36 to 2.40
- ISO filename, build container, and docs updated throughout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/scripts/build-backend.sh

@@ -32,7 +32,7 @@ if [ "$USE_DOCKER" = true ]; then
         -v "$PROJECT_ROOT:/workspace" \
         -v "$OUTPUT_DIR:/output" \
         -w /workspace/core/archipelago \
-        rust:bookworm \
+        rust:trixie \
         sh -c '
             echo "📦 Installing build dependencies..."
             apt-get update && apt-get install -y pkg-config libssl-dev