fix: refresh rotted apt version pins in Dockerfile

The build was broken on a fresh clone: 8 pinned package versions no
longer exist in the Debian 13 (trixie) archive after security/point
updates over the past couple of months, so apt-get failed with
"Version ... was not found" and the dev image could not be built.

Refreshed the rotted pins to currently-available versions:
- curl 8.14.1-2+deb13u2 -> 8.14.1-2+deb13u4
- grub-pc-bin / grub-efi-amd64-bin / grub-efi-ia32-bin 2.12-9+deb13u1 -> 2.12-9+deb13u2
- shim-signed 1.47+15.8-1 -> 1.51~1+deb13u1+16.1-2~deb13u1
- systemd-boot-efi 257.9-1~deb13u1 -> 257.13-1~deb13u1
- gpg / gpg-agent 2.4.7-21+deb13u1+b2 -> 2.4.7-21+deb13u1+b4

Image builds cleanly; full suite still 782 pass / 0 fail; lint clean.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

Dockerfile

@@ -16,7 +16,7 @@ ENV TZ=UTC
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates=20250419 \
     gnupg=2.4.7-21+deb13u1 \
-    curl=8.14.1-2+deb13u2 \
+    curl=8.14.1-2+deb13u4 \
     wget=1.25.0-2 \
     git=1:2.47.3-0+deb13u1 \
     && apt-get clean \
@@ -31,9 +31,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     debootstrap=1.0.141 \
     squashfs-tools=1:4.6.1-1 \
     xorriso=1.5.6-1.2+b1 \
-    grub-pc-bin=2.12-9+deb13u1 \
-    grub-efi-amd64-bin=2.12-9+deb13u1 \
-    grub-efi-ia32-bin=2.12-9+deb13u1 \
+    grub-pc-bin=2.12-9+deb13u2 \
+    grub-efi-amd64-bin=2.12-9+deb13u2 \
+    grub-efi-ia32-bin=2.12-9+deb13u2 \
     mtools=4.0.48-1 \
     dosfstools=4.2-1.2 \
     syslinux-utils=3:6.04~git20190206.bf6db5b4+dfsg1-3.1 \
@@ -64,10 +64,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Install Secure Boot and signing tools
 RUN apt-get update && apt-get install -y --no-install-recommends \
     sbsigntool=0.9.4-3.2 \
-    shim-signed=1.47+15.8-1 \
-    systemd-boot-efi=257.9-1~deb13u1 \
-    gpg=2.4.7-21+deb13u1+b2 \
-    gpg-agent=2.4.7-21+deb13u1+b2 \
+    shim-signed=1.51~1+deb13u1+16.1-2~deb13u1 \
+    systemd-boot-efi=257.13-1~deb13u1 \
+    gpg=2.4.7-21+deb13u1+b4 \
+    gpg-agent=2.4.7-21+deb13u1+b4 \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*