Lower the release glibc floor to cover every supported Debian/Ubuntu

## Why

Since #174, the `.deb` declares the glibc floor it actually needs, derived from the shipped binaries. Today that floor is **2.39**, because `docker/Dockerfile.host-builder` is `FROM ubuntu:24.04`.

Users can fairly expect Capsem to work on every supported Debian and Ubuntu release. It currently does not:

| Distro | glibc | Status |
|---|---|---|
| Ubuntu 24.04 LTS, 26.04 LTS | 2.39 / 2.41+ | works |
| Debian 13 trixie (stable) | 2.41 | works |
| **Ubuntu 22.04 LTS** (supported to 2027-04) | 2.35 | **refused** |
| **Debian 12 bookworm** (LTS to 2028) | 2.36 | **refused** |
| Linux Mint 21.x, Pop!_OS 22.04 | 2.35 | refused |

Before #174 these installed cleanly and then every binary failed at runtime. They now get an honest refusal, which is better but still not support.

## The lever

The floor is a build-image choice, not a code constraint. Nothing in Capsem requires 2.39. Basing `Dockerfile.host-builder` on `ubuntu:22.04` derives a 2.35 floor and covers everything in the table except Ubuntu 20.04 and Debian 11, both of which are out of standard support. `libwebkit2gtk-4.1-0` is available in jammy, so the GUI dependencies still resolve.

Lowering the floor is purely additive: no installed user breaks when it drops.

## Scope

- Move the release build base down and let `scripts/derive-deb-libc-floor.py` re-derive the floor.
- Confirm the Rust toolchain and `webkit2gtk-4.1` build cleanly on the older base.
- The glow-up Debian proof added alongside this issue asserts install succeeds iff the probe image's glibc satisfies the declared floor, so it follows the change automatically rather than needing an update.

## Not in scope

Ubuntu 20.04 / Debian 11 (glibc 2.31), both past standard support.

Start in docker/Dockerfile.host-builder and scripts/derive-deb-libc-floor.py; inspect how the build image determines the declared glibc floor. Build the release artifacts on Ubuntu 22.04, verify the Rust toolchain and webkit2gtk-4.1 dependencies resolve, and run the Debian proof with its glibc probe. Done means the build succeeds and the derived floor covers glibc 2.35 without requiring a proof update.

Written by the indexing model from the issue text.