Stabilize runtime image, add PR-based version gating, drop arm/v7

Dockerfile:
- Keep build stage on debian:sid-slim (required for riscv64 Go support)
- Switch runtime stage to debian:bookworm-slim for stable, predictable
  package names — eliminates the libcbor0 class of breakage for users

update-check.py:
- Create a branch and open a PR instead of pushing directly to master
- PR body links to upstream release notes and prompts review of new
  dependencies before merge
- Remove dead deb/PACKAGE code

build.yaml:
- Drop linux/arm/v7 — upstream go-libfido2 is incompatible with 32-bit
  ARM address space as of v3.22.0; not fixable without upstream changes
- Add VERSION to pull_request trigger paths so the test job builds
  and validates every version bump PR before it can be merged

update-check.yaml:
- Pass GITHUB_TOKEN and GITHUB_REPOSITORY to script for PR creation

README.md:
- Document arm/v7 as unsupported with reason

.github/workflows/build.yaml

@@ -10,13 +10,14 @@ on:
     paths:
       - .github/workflows/build.yaml
       - build/*
+      - VERSION
   workflow_dispatch:
 
 env:
   DOCKERHUB_REPO: dancwilliams/protonmail-bridge
   GHCR_REPO: ghcr.io/dancwilliams/protonmail-bridge-docker
   DOCKER_REPO_DEV: ghcr.io/dancwilliams/protonmail-bridge
-  PLATFORMS: linux/amd64,linux/arm64/v8,linux/arm/v7,linux/riscv64
+  PLATFORMS: linux/amd64,linux/arm64/v8,linux/riscv64
 
 jobs:
   test:
@@ -81,7 +82,6 @@ jobs:
         platform:
           - linux/amd64
           - linux/arm64/v8
-          - linux/arm/v7
           - linux/riscv64
     steps:
       - name: Checkout