docs(deploy): full-track note + base-image drift workaround

The clean rebuild re-pulls python:3.12-slim (now Debian trixie) whose apt layer
fails on erable's old Docker. Document the pin-the-digest fix and the
source-only overlay-build shortcut so the next deploy doesn't rediscover it.

armada/api/DEPLOY.md

@@ -33,6 +33,15 @@ docker build -t fourier:latest armada/api      # ~1 GB image, light engine only
 
 (Or build on the dev box and `docker save fourier:latest | ssh erable docker load`.)
 
+> **Base-image drift (bit us 2026-07-23).** A clean rebuild re-pulls
+> `python:3.12-slim`, which now tracks Debian **trixie** — and its apt layer
+> fails in erable's old Docker (`APT::Update::Post-Invoke … Sub-process returned
+> an error`). Two fixes: **pin the base** to a working digest
+> (`FROM python:3.12-slim@sha256:…`) so rebuilds are reproducible — the proper
+> fix; or, for a **source-only** change (no dep change), skip the base entirely
+> and overlay onto the running image:
+> `printf 'FROM fourier:latest\nCOPY . /app\n' | docker build -t fourier:latest -f - .`
+
 ## 2. State volume
 
 One writable dir at `/data` holds the content-addressed **cache** (transient,