build(docker): install Chromium from trixie-security without the snapshot pin (#1648)

Following the discussion on #1635, this drops the Chromium snapshot pin
and the apt preference, and installs whatever trixie-security currently
ships. Thanks @calibrain for suggesting we try it.

With no pin there is nothing left to go stale, so the scheduled check
that issue asked for isn't needed. Closes #1635.

I built the image from this branch and ran it as a scratch container. It
has Chromium 156.0.8078.79, and the bypass cleared DDoS-Guard on Anna's
Archive and returned search results. That challenge cleared on the
auto-wait step, so the click path wasn't exercised, same as the open
question in #1635.

One thing to know: the build cache is keyed on the Dockerfile text, so a
newer Debian Chromium only lands when that layer rebuilds, for example
on a base image bump.

.github/workflows/build-and-publish-docker-image.yml

@@ -77,7 +77,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
           # Runners are ephemeral, so without this every layer is rebuilt on every
-          # run: the pinned Chromium install, the dependency syncs, the driver
+          # run: the Chromium install, the dependency syncs, the driver
           # setup. Scoped per target so the two images do not evict each other. A cache
           # export error (ignore-error defaults to false) should not fail a finished publish.
           cache-from: type=gha,scope=${{ matrix.target }}

Dockerfile

@@ -148,26 +148,16 @@ ENTRYPOINT ["/usr/bin/dumb-init", "--"]
 
 FROM base AS shelfmark
 
-# --- Chromium (PINNED to 156.0.8078.73) ---
-ARG CHROMIUM_VERSION=156.0.8078.73-1~deb13u1
-ARG CHROMIUM_SNAPSHOT=20261029T020000Z
-
-RUN echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/${CHROMIUM_SNAPSHOT}/ trixie-security main" \
-        > /etc/apt/sources.list.d/chromium-pin-snapshot.list && \
-    apt-get update -o Acquire::Retries=5 && \
+# --- Chromium (Debian's current build from trixie-security) ---
+RUN apt-get update -o Acquire::Retries=5 && \
     apt-get install -y --no-install-recommends -o Acquire::Retries=5 \
     # For dumb display
     xvfb \
-    chromium=${CHROMIUM_VERSION} \
-    chromium-common=${CHROMIUM_VERSION} \
+    chromium \
     # For tkinter (pyautogui)
     python3-tk \
     # For RAR extraction
     unrar-free && \
-    # Keep apt from "upgrading" chromium past the pin inside derived images
-    printf 'Package: chromium chromium-common\nPin: version %s\nPin-Priority: 1001\n' "${CHROMIUM_VERSION}" \
-        > /etc/apt/preferences.d/chromium-pin && \
-    rm /etc/apt/sources.list.d/chromium-pin-snapshot.list && \
     # Create symlink so rarfile library can find unrar
     ln -sf /usr/bin/unrar-free /usr/bin/unrar && \
     # Cleanup APT cache