chore: Debian 12 → 13 (Trixie) migration, service hardening

- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie)
- Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime
  in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no)
- Update GLIBC compatibility checks from 2.36 to 2.40
- ISO filename, build container, and docs updated throughout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/install-tui-demo.sh

@@ -273,7 +273,7 @@ PHASE_DETAILS=(
     "/dev/sda (465.8G) — TOSHIBA MQ01ACF0"
     "BIOS boot + EFI + root + data"
     "FAT32, ext4, LUKS2"
-    "debootstrap → Debian 12 minimal"
+    "debootstrap → Debian 13 minimal"
     "AES-256-XTS (AES-NI detected)"
     "GRUB: BIOS + UEFI hybrid"
 )