deploy: fix image build — trixie/go1.24 base, rename off the maven collision

Three fixes found bringing the stack up on the host daemon:

- base was golang:1.23-bookworm: bookworm's glibc 2.36 / GLIBCXX 3.4.30 is too
  old to link the prebuilt deps/lib/*.so (built on Arch against glibc 2.38 /
  GLIBCXX 3.4.32). Moved build+runtime to trixie (glibc 2.40). golang trixie
  images start at 1.24, which builds the go 1.23 module fine.
- builder now installs libvulkan-dev — libggml-vulkan.so needs libvulkan.so.1
  at link time.
- image renamed maven:latest -> mavenai:latest with pull_policy:never. "maven"
  is Apache Maven on Docker Hub; compose was silently pulling it, so every
  container ran mvn-entrypoint.sh and exited 127.

Verified on the host: all six build, five-service stack stays up, mavend opens
the encrypted db, mavweb GET :9201 -> 200.

Dockerfile

@@ -12,9 +12,18 @@
 # ponytail: prebuilt-lib copy, not a from-source build. Add a whisper.cpp build
 # stage if you ever need reproducibility / a different arch than the host libs.
 
-FROM golang:1.23-bookworm AS build
+# trixie, not bookworm: the prebuilt deps/lib/*.so are linked against
+# glibc 2.38 + GLIBCXX 3.4.32 (built on the Arch host). bookworm's glibc 2.36
+# is too old and the link fails on missing symbols. trixie ships glibc 2.40.
+# 1.24 (not 1.23) because golang trixie images start at 1.24; go 1.24 builds the
+# `go 1.23` module fine (the directive is a minimum).
+FROM golang:1.24-trixie AS build
 WORKDIR /src
 
+# libvulkan-dev: libggml-vulkan.so needs libvulkan.so.1 at link time.
+RUN apt-get update && apt-get install -y --no-install-recommends libvulkan-dev \
+    && rm -rf /var/lib/apt/lists/*
+
 # native build inputs (prebuilt libs + headers), then module cache, then source
 COPY deps/lib/ /src/deps/lib/
 COPY deps/piper/ /src/deps/piper/
@@ -37,7 +46,7 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
     go build -o /out/mavcaldav ./cmd/mavcaldav
 
-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime
 RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 && \
     rm -rf /var/lib/apt/lists/*

docker-compose.yml

@@ -6,7 +6,10 @@ name: maven
 # the bare-metal setup, only paths move to /run/maven.
 
 x-image: &image
-  image: maven:latest
+  # NOT "maven" — that's Apache Maven on Docker Hub and compose will happily
+  # pull it, giving every container `mvn-entrypoint.sh` and exit 127.
+  image: mavenai:latest
+  pull_policy: never   # only ever the locally-built image
   restart: unless-stopped
 
 services: