feat: build OCI image for Workshop server via Bazel

[ecalifornica]

Builds an OCI image of the Workshop server on top of debian:trixie-slim.

Layers, bottom up:

• debian:trixie-slim base
• git + ca-certificates via rules_distroless
• claude via http_file
• work binary with embedded UI

Targets: //packages/workshop:image and //packages/workshop:image_load.

Usage

Both commands need --config=opt so rust-embed bakes the UI into the binary. A follow-up PR will add debug-embed to lift that requirement.

bazel build --config=opt //packages/workshop:image
bazel run --config=opt //packages/workshop:image_load

Notes

bazel_lib replaces aspect_bazel_lib. rules_distroless 0.6.2 requires bazel_lib 3.x.

Regenerate the apt lockfile after changing apt_packages.yaml:

bazel run @workshop_apt//:lock

I'm new to bazel, please let me know if these changes aren't idiomatic.