Fix Dockerfile: use mcr.microsoft.com/dotnet/runtime:8.0 as base, add Makefile

Dockerfile:
- Final stage now FROM mcr.microsoft.com/dotnet/runtime:8.0 instead of python:3.12-slim
  + MS apt repo. Reason: packages.microsoft.com GPG key uses SHA1 which Debian trixie
  rejects since 2026-02-01. The official MS container image has no signing issue.
- Add python3 + pip3 + wget on top of dotnet base (bookworm)
- pip3 install --break-system-packages for debian bookworm compatibility

Makefile targets:
  make build        - build image locally
  make rebuild      - force no-cache build
  make run          - build + start container with port mappings
  make run-quick    - start without rebuilding
  make stop/restart - container lifecycle
  make logs         - follow logs
  make shell        - bash into running container
  make health       - curl health endpoint
  make smoke        - end-to-end TCP + health test (scripts/smoke_test.sh)
  make test         - unit tests (pytest, no Docker)
  make ps/ports     - status helpers
  make clean        - stop + remove image

Dockerfile

@@ -25,16 +25,14 @@ RUN pip install --upgrade pip build \
 
 
 # ── Stage 3: final runtime ────────────────────────────────────────────────────
-FROM python:3.12-slim
+# Use Microsoft's official .NET runtime image — avoids the SHA1-signed APT key
+# issue on newer Debian hosts (trixie+ rejects packages.microsoft.com GPG since 2026-02-01).
+FROM mcr.microsoft.com/dotnet/runtime:8.0
 
-# Install .NET runtime (needed by Bicep.LangServer.dll)
+# Install Python 3 + pip (the dotnet base image is Debian bookworm)
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-        wget apt-transport-https ca-certificates \
-    && wget -q https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb \
-    && dpkg -i packages-microsoft-prod.deb && rm packages-microsoft-prod.deb \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends dotnet-runtime-8.0 \
+        python3 python3-pip wget \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy Bicep Language Server (baked in at build time — no volume needed)
@@ -42,7 +40,7 @@ COPY --from=bicep-downloader /opt/bicep-langserver /opt/bicep-langserver
 
 # Install Python package and dependencies
 COPY --from=builder /dist/*.whl /tmp/
-RUN pip install --no-cache-dir /tmp/*.whl && rm /tmp/*.whl
+RUN pip3 install --no-cache-dir --break-system-packages /tmp/*.whl && rm /tmp/*.whl
 
 # Configuration defaults (override via Nomad env)
 ENV PYTHON_LSP_PORT=2087 \