fix(docker): pin runtime base to alpine:3.24

The runtime stage used a floating `alpine`, and the release workflow only
rebuilds the version and `latest` tags on a `v*` tag push. The published
2.1.1 / latest image therefore still ships Alpine 3.23.3, whose musl,
zlib and openssl packages have fixes available in later revisions.

Pinning to the 3.24 branch rather than an exact 3.24.1: this repo has no
dependabot or renovate config, so an exact pin would go stale with no
mechanism to bump it. The branch pin still picks up patch-level security
fixes on every build while removing the risk of a major Alpine bump
landing unnoticed in a release build.

Note that this does not refresh anything already published; the tags are
only rebuilt when a new release is cut.

Refs #738

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: undera

Dockerfile

@@ -38,7 +38,7 @@ WORKDIR /build/src
 RUN make build_go
 
 # Stage - runner
-FROM --platform=${TARGETPLATFORM:-linux/amd64} alpine
+FROM --platform=${TARGETPLATFORM:-linux/amd64} alpine:3.24
 
 ARG TARGETPLATFORM
 ARG BUILDPLATFORM