build: follow Core and Optimizer onto the trixie base

[HuggeK]

Note

Route-independent — this PR is needed either way. Upstream is choosing
between two routes for the base change:
srcfl/ftw#731 (whole stack on
debian:trixie-slim) and its alternative
srcfl/ftw#746 (core and updater on one
alpine:3.22 base, .local resolved natively in Go).

Both move Dockerfile.optimizer to python:3.12-slim-trixie — #746
because CVXPY publishes no musllinux wheels, so the optimizer cannot follow the
other two onto Alpine and only leaves oldstable. Since this repo builds
FROM ${FTW_OPTIMIZER_FROM}, the add-on lands on trixie under either route, so
the fixture change here is correct whichever is merged.

The one thing that does change with the route is the note about libnss-mdns
below: under #746 it is not in the Core image at all, because musl has no NSS
plugin mechanism. The conclusion for this repo is unaffected — the add-on never
installs it and always resolves .local in-process.

---

Important

Blocked by srcfl/ftw#731, which
moves the FTW stack onto Debian 13 "trixie". Merge that first — until it ships,
the fixtures here would be testing a newer base than the images they stand in
for, which is the same mismatch this PR exists to remove.

What & why

The add-on image is built FROM ${FTW_OPTIMIZER_FROM}, so it inherits the base
of the real Optimizer image. srcfl/ftw#731 moves that from
python:3.12-slim-bookworm to python:3.12-slim-trixie — meaning this repo
follows along whether or not anything changes here.

What does not follow along is tests/fixtures/. Both fixtures pin
python:3.12-slim-bookworm and are what check.yml builds and smoke-tests
against. Left alone they would keep certifying the add-on on a base that no
longer ships, which is precisely the case where a base-specific regression walks
through a green check.

Changes

• tests/fixtures/core/Dockerfile, tests/fixtures/optimizer/Dockerfile
  — python:3.12-slim-bookworm → python:3.12-slim-trixie, with a comment
  naming what they track and why drift matters.
• ftw/Dockerfile — comments only. Records that the suite arrives via
  FTW_OPTIMIZER_FROM, that the package set was verified on the new base, and
  why libnss-mdns is deliberately not installed here even though Core has it.
• ftw/DOCS.md — a short operator section on devices addressed by .local
  name.

No version bump and no CHANGELOG.md entry: nothing user-visible changes for an
already-published version, and the release flow owns those files.

Why libnss-mdns belongs in Core but not here

Core installs it so ordinary glibc tools in that image (getent, curl,
wget) resolve .local. It works by forwarding to avahi-daemon over
/run/avahi-daemon/socket, which has to be bind-mounted from the host.

Supervisor gives an add-on no way to bind an arbitrary host path — only a fixed
set of named ones (config, ssl, share, media, backup, …). So the
package would resolve nothing here, while suggesting to the next reader that it
does.

FTW resolves .local in-process instead
(srcfl/ftw#728), asking a host avahi
where one is reachable and querying the network directly otherwise. The add-on
always takes the second path, which is what host_network: true in
config.yaml provides. Nothing is lost — that path needs no host software.

Verification

Run locally against the updated fixtures, on the real new base:

• docker build tests/fixtures/core and tests/fixtures/optimizer — both build.
• The add-on image builds on top of them (FTW_CORE_FROM / FTW_OPTIMIZER_FROM
  pointed at the fixtures, exactly as check.yml does).
• scripts/smoke.sh ftw-addon:verify → smoke test passed.
• In the running container: /etc/debian_version = 13.6,
  /usr/local/bin/healthcheck.py OK, /opt/venv/bin/ftw-optimizer-healthcheck
  OK, tini present at /usr/bin/tini where the ENTRYPOINT expects it.
• apt-get install --no-install-recommends ca-certificates tini tzdata resolves
  on python:3.12-slim-trixie — checked directly, since an unavailable package
  on the new suite would have been the one real hazard in ftw/Dockerfile.
• python -m compileall -q ftw scripts tests/fixtures passes.

scripts/validate.py was not run: it imports yaml, which is not installed
here, and installing it was out of scope. No YAML file is touched by this diff.