Move the IPAM image and dev container to Debian 13 #134

The IPAM service runs in production on a Debian 12 distroless base, whose CA list still trusts the compromised eMudhra root (datum-cloud/infra#7423). Its outbound TLS would accept a forged certificate chained to that root. Debian 13 distroless dropped the root. The builder stage and the dev container also use Debian 12.

Success looks like

• The runtime image builds on Debian 13 distroless with the same non-root user, and its CA list lacks the root
• The builder stage and the dev container use Debian 13
• Production runs a release built this way

Related to datum-cloud/infra#7481