The base image is 76% of the download: move to aspnet:10.0-noble-chiseled-extra

Of the 115.6 MB a client downloads for `ghcr.io/baryodev/barako-cms`, 88.1 MB is the `mcr.microsoft.com/dotnet/aspnet:10.0` base. Everything else put together, the core, fourteen modules and every dependency, is 27.5 MB.

Measured, not estimated. Base images, compressed, linux/arm64 from the MCR manifests:

| Base | Compressed |
| --- | --- |
| `10.0` (current) | 88.1 MB |
| `10.0-noble-chiseled-extra` | **63.9 MB** |
| `10.0-alpine` | 52.1 MB |
| `10.0-noble-chiseled` | 49.0 MB |

`noble-chiseled-extra` is the right target. Plain `noble-chiseled` is globalization-invariant, and the current base deliberately installs `libicu74`, `tzdata` and `tzdata-legacy`, so dropping ICU would be a behaviour change rather than a size win. Alpine means musl and a different publish RID for a smaller saving.

### Built it and it works

Same published output, chiselled base:

| | On disk |
| --- | --- |
| `barako-cms:4.0.1` | 442.7 MiB |
| same on `10.0-noble-chiseled-extra` | **323.4 MiB** |

27% off, from changing one `FROM` line in `Dockerfile` and `Dockerfile.suite`.

It boots. The container ran to the application's own configuration check (`No database connection string. Set ConnectionStrings:DefaultConnection`) with zero native or loader errors: no missing shared object, no ICU failure, no `DllNotFound`. The runtime, OpenSSL and globalization all resolve.

### What it costs

**There is no shell.** `docker run --entrypoint="" ... sh -c` fails with `exec: "sh": executable file not found in $PATH`. That is most of the security benefit and all of the operational cost. It interacts directly with #662, where `db-assert` and `db-patch` do not exist on the published image: whatever that issue lands on has to work without a shell, which probably means the commands run through the app's own entry point rather than a script.

`docker exec` for debugging is gone too. Worth deciding deliberately, because somebody will want it at 2am.

### Do this before the assembly work

The two dependency cleanups filed alongside this, #745 (KubernetesClient, 2.3 MB compressed) and #746 (HealthChecks.UI and its EF Core and Roslyn tail, 6.8 MB), are both worth doing. Neither is close to this one: 24.2 MB for one line against 9.1 MB for two refactors that each need an assembly boundary and a contract decision.

Start with the FROM lines in Dockerfile and Dockerfile.suite, then review the image build and startup checks described in the issue. Change the base image to aspnet:10.0-noble-chiseled-extra and verify that the application reaches its configuration check without native, loader, or ICU errors. Consider the shell-less behavior alongside issue #662.

Written by the indexing model from the issue text.