feat(build): Switch to docker hardened image

[oioki]

Another attempt of #6117 (switching to Docker Hardened Image)

#6234 reverted it because Cloud Build could not pull the resulting images — buildx published them with zstd-compressed layers, which the Docker version Cloud Build runs does not understand. That is now fixed upstream in action-build-and-push-images (#21), which forces gzip layer compression on published images, so this bumps the pinned action to d91c0db.

[sentry]

Bug: The COPY instruction may not create /etc/relay and /work if /home/nonroot is empty, leading to incorrect root ownership when VOLUME creates them later.
_{Severity: CRITICAL}

Suggested Fix

Instead of relying on COPY to create the directories, explicitly create them and set their ownership before the VOLUME instruction. For example, use RUN mkdir /etc/relay /work && chown nonroot:nonroot /etc/relay /work before copying any files into them.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: Dockerfile.release#L12-L13

Potential issue: The Dockerfile uses `COPY --from=builder /home/nonroot ...` to create
the `/etc/relay` and `/work` directories with `nonroot` ownership. However, Docker's
`COPY` instruction does not copy empty directories. If the source `/home/nonroot`
directory is empty, as a code comment suggests, the `COPY` commands will not create the
destination directories. The subsequent `VOLUME` instruction will then create them at
runtime, but they will be owned by `root`. When the application, running as the
`nonroot` user, tries to access these directories, it will likely fail with permission
denied errors.

_{Did we get this right? 👍 / 👎 to inform future reviews.}