Remove the UPX packing option and its build dependencies

[m-reuter]

Follow-up cleanup to #883, which stopped passing --upx to install_fs_pruned.sh. That left the
machinery in place but unreachable. This removes it, so the option cannot be turned back on by
accident.

Context in #882: UPX self-extraction stubs are SIGKILLed at launch on hosts running CrowdStrike
Falcon, which surfaces as what looks like an out-of-memory failure.

What goes

tools/Docker/Dockerfile, the build_base apt list: upx, and file with it. file was
only ever there for the packing block, which located ELF binaries with
find "$fsd/bin" -exec file {} \; | grep ELF. aria2 and ca-certificates stay, both used by
the downloader.

tools/build/install_fs_pruned.sh: the usage lines, the upx="false" default, the parser
case, the upx=$upx component of the cache stamp, and the packing block itself.

Removed rather than left unused. The argument parser ends in
*) echo "Invalid argument $1" ; exit 1 ;;, so a stale caller passing --upx now exits 1 with
Invalid argument --upx instead of being silently ignored, which is the right outcome for
something that caused this class of failure.

The macOS build never passed --upx (build_release_package.sh:156), so it is unaffected.

Caches invalidate, on purpose

cache_stamp includes a sha256 of the script, so this commit invalidates every pruned-install
cache: the Docker build_freesurfer stage and the macOS --fs-pruned-cache-dir. Both re-prune
from scratch, which is what guarantees unpacked binaries. Each pays one full download and prune
the next time it runs.

This still does not fix the official images

Release builds copy FreeSurfer from the prebuilt deepmi/fastsurfer-build:freesurfer741 rather
than compiling the stage, and that image is not a stamped cache, so no code change reaches it. It
has to be rebuilt and republished from the merged code:

python tools/Docker/build.py --device cpu --target build_freesurfer \
  --tag deepmi/fastsurfer-build:freesurfer741 --action push

The tag is derived from tool.freesurfer.version, so it is overwritten in place and anyone
holding a cached copy needs to pull explicitly