dockerimg: switch to a debian base image

Developing on a musl-based alpine image seems to suck.
A lot of python stuff doesn't work.
Even when told it's alpine, LLMs still want to apt-get install things.

Along with switching to debian, simplify everything.
We *always* use debian bookwork now. If there are python
things, the LLM needs to install them on top of the model.
This will make fallback mode easier: if a build fails, then we
drop ExtraCmds and try again. (Future work.)

While here: avoid using docker buildx in tests because
it seems to vary a lot version-to-version.
diff --git a/dockerimg/dockerimg_test.go b/dockerimg/dockerimg_test.go
index f9155c4..1791677 100644
--- a/dockerimg/dockerimg_test.go
+++ b/dockerimg/dockerimg_test.go
@@ -2,12 +2,10 @@
 
 import (
 	"context"
-	"encoding/json"
 	"flag"
 	"io/fs"
 	"net/http"
 	"os"
-	"os/exec"
 	"strings"
 	"testing"
 	"testing/fstest"
@@ -197,36 +195,26 @@
 // TestDockerHashIsPushed ensures that any changes made to the
 // dockerfile template have been pushed to the default image.
 func TestDockerHashIsPushed(t *testing.T) {
-	name, _, hash := DefaultImage()
+	name, _, tag := DefaultImage()
 
-	cmd := exec.Command("docker", "buildx", "imagetools", "inspect", name, "--raw")
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Logf("command %v", cmd.Args)
-		t.Fatalf("failed to inspect docker image %s: %v: %s", name, err, out)
-	}
+	if err := checkTagExists(tag); err != nil {
+		if strings.Contains(err.Error(), "not found") {
+			t.Fatalf(`Currently released docker image %s does not match dockerfileCustomTmpl.
 
-	var config struct {
-		Annotations map[string]string `json:"annotations"`
-	}
-	if err := json.Unmarshal(out, &config); err != nil {
-		t.Fatal(err)
-	}
-	rev := config.Annotations["org.opencontainers.image.revision"]
-	if rev != hash {
-		t.Fatalf(`Currently released docker image %s does not match dockerfileCustomTmpl.
-
-Inspecting the docker image shows revision hash %s,
-but the current hash of dockerfileCustomTmpl is %s.
+Inspecting the docker image shows the current hash of dockerfileBase is %s,
+but it is not published in the GitHub container registry.
 
 This means the template constants in createdockerfile.go have been
-edited (e.g. defaultBaseImg or dockerfileBaseTmpl), but a new version
+edited (e.g. dockerfileBase changed), but a new version
 of the public default docker image has not been built and pushed.
 
 To do so:
 
 	go run ./dockerimg/pushdockerimg.go
 
-`, name, rev, hash)
+`, name, tag)
+		} else {
+			t.Fatalf("checkTagExists: %v", err)
+		}
 	}
 }