Revert "build(docker): Switch to Docker Hardened Images (DHI)"

[oioki]

Reverts #212

as this breaks acceptance tests:
https://github.com/getsentry/sentry/actions/runs/22585881666/job/65430559555

Container chartcuterie did not become healthy within 120 seconds.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Missing WORKDIR causes massive image bloat via symlink

Medium Severity

The builder stage has no WORKDIR, so the default / is used. The tsc build outputs to ./lib, which resolves to /lib — a symlink to /usr/lib on Debian bookworm (usrmerge). Docker's COPY --from=builder lib lib follows symlinks, so it copies the entire /usr/lib directory (system libraries + build output) into the runtime image. The removed DHI version had WORKDIR /build to avoid this. Adding a WORKDIR to the builder stage would prevent copying hundreds of megabytes of unnecessary system libraries.

Additional Locations (1)

• Dockerfile#L32-L33