feat(docker): Build a distroless image variant

[oioki]

Add a taskbroker-distroless stage to the Dockerfile and publish it next to the current image:

• ghcr.io/getsentry/taskbroker:<sha>-distroless and :nightly-distroless (amd64 + arm64)
• <sha>-distroless in us-central1-docker.pkg.dev/sentryio/taskbroker/image and us-docker.pkg.dev/sentryio/taskbroker-mr/image

The debian stage stays last, so builds without --target produce the same image, and :nightly, :latest and self-hosted are unchanged. Nothing deploys the distroless image yet. The self-hosted e2e test now runs against both variants.

The base is the DHI static glibc Debian 13 image from the AR mirror, the same one relay uses. It has no shell or package manager and runs as nonroot (uid 65532). Brokers in k8s already use gRPC probes and set runAsUser: 1000 with fsGroup, so switching a region only needs the image tag.

This also changes the current image. The first commit builds rdkafka with ssl-vendored and libz-static (like getsentry/relay#4978), so the binary only needs glibc. The debian image runs the same binary, so production moves from the system libssl3 to OpenSSL 3.6 from openssl-src. Brokers use sasl_plaintext with SCRAM, so this affects SASL hashing, not certificate handling. OpenSSL updates now come through openssl-src bumps instead of the base image. I can split this commit into its own PR if we'd rather deploy it alone first.

The distroless stage copies a prepared /opt onto /: the base already has a root-owned /opt and no shell to fix that, and taskbroker reads ./VERSION and defaults to ./taskbroker-inflight.sqlite relative to it. The distroless builds read the per-architecture build cache from #817 but don't export it, so they don't overwrite the default build's cache index.

trivy, local arm64 builds of this branch:

Image	OS vulns	Size (gzip)
debian (current)	1208 (1 critical, 103 high)	113 MB
distroless	23 (medium/low, glibc)	60 MB

Other bases considered: gcr.io/distroless/cc-debian13 ships libssl3 and zlib, so it needs no Cargo change, but it isn't the DHI base the rest of Sentry uses. A fully static musl build would use the musl allocator, which is slow under multithreaded load.

🤖 Generated with Claude Code