deploy: fix image build — trixie/go1.24 base, rename off the maven collision

Three fixes found bringing the stack up on the host daemon:

- base was golang:1.23-bookworm: bookworm's glibc 2.36 / GLIBCXX 3.4.30 is too
  old to link the prebuilt deps/lib/*.so (built on Arch against glibc 2.38 /
  GLIBCXX 3.4.32). Moved build+runtime to trixie (glibc 2.40). golang trixie
  images start at 1.24, which builds the go 1.23 module fine.
- builder now installs libvulkan-dev — libggml-vulkan.so needs libvulkan.so.1
  at link time.
- image renamed maven:latest -> mavenai:latest with pull_policy:never. "maven"
  is Apache Maven on Docker Hub; compose was silently pulling it, so every
  container ran mvn-entrypoint.sh and exited 127.

Verified on the host: all six build, five-service stack stays up, mavend opens
the encrypted db, mavweb GET :9201 -> 200.

docker-compose.yml

@@ -6,7 +6,10 @@ name: maven
 # the bare-metal setup, only paths move to /run/maven.
 
 x-image: &image
-  image: maven:latest
+  # NOT "maven" — that's Apache Maven on Docker Hub and compose will happily
+  # pull it, giving every container `mvn-entrypoint.sh` and exit 127.
+  image: mavenai:latest
+  pull_policy: never   # only ever the locally-built image
   restart: unless-stopped
 
 services: