Migrate Docker images to Alpine base + CI enforcement and image performance checks

[RudoiDmytro]

Description

All container images in this repository should use Alpine-based Docker images wherever feasible. Alpine variants are significantly smaller and reduce the attack surface compared to the Debian-based images we use today.

Currently Dockerfile is built on oven/bun:1.3.5 (Debian/glibc) and installs packages via apt-get. We should migrate to the Alpine variant and add CI guardrails so this convention is enforced and image performance is tracked.

Origin

Raised in PR #37 review (reviewer @Kravalg) on Dockerfile. Migration deferred to this issue because it requires a non-trivial apt-get → apk / glibc → musl port that must be validated separately from the tooling-foundation PR.

Tasks

• Migrate Dockerfile from oven/bun:1.3.5 (Debian) to the Alpine variant (oven/bun:1.3.5-alpine), porting apt-get installs to apk and validating musl compatibility for the build toolchain (g++, make, python3, procps, bash, Node/npm).
• Audit and migrate any other Dockerfiles (e.g. the k6 load-test image at tests/load/Dockerfile) to Alpine where possible.
• Verify the full toolchain (bun install --frozen-lockfile, build, unit/e2e/visual/memory-leak suites) passes on the Alpine image.
• Add a CI check that fails when a Dockerfile uses a non-Alpine base image where an Alpine variant exists (regression guard).
• Add a CI check that benchmarks Dockerfile build performance and final image size (size budget + build-time reporting), warning/failing on regressions.
• Document the Alpine policy and the new CI checks in CONTRIBUTING/docs.

Acceptance Criteria

• All project Dockerfiles use Alpine-based images where an Alpine variant is available, or carry a documented, justified exception.
• Images build successfully and all existing CI suites pass on the Alpine images.
• CI fails on a newly introduced non-Alpine base image.
• CI reports Docker image size and build performance against a defined threshold/budget.
• Final image size is measurably reduced versus the current Debian-based image (before/after captured).