chore(images): migrate base images to private -stable aliases

[dliub]

What

Re-homes base images to Hasura's private Artifact Registry us-docker.pkg.dev/hasura-container-images/external-images via floating -stable aliases. The -stable aliases are auto-advanced to the latest patched digest of the same version line, so this stays on the same version while picking up security patches automatically.

Per Hasura policy, every container deployed in Hasura infra must be pulled from the private Artifact Registry, not from upstream registries (Docker Hub, ghcr.io, gcr.io, etc.). Upstream base images are vendored there using a preserve-source path layout.

Exact FROM swaps

Dockerfile

• FROM golang:1.24 → FROM us-docker.pkg.dev/hasura-container-images/external-images/docker.io/library/golang:1.24-stable
  (preserving the AS builder suffix)

Notes

• Part of an org-wide Phase 1 migration: exact-match swaps only — no version bumps, no reformatting, no changes to any other lines or files.
• The gcr.io/distroless/static-debian12:nonroot FROM line in this Dockerfile was not in scope for this swap and is intentionally left unchanged.

[dliub]

Closing as out-of-scope: this PR came from an exploratory org-wide base-image -stable migration sweep that we've scoped down to PromptQL self-hosted images only. Reopen if needed.