Debian 11 left LTS at the end of August 2026. The runtime stage's
`apt-get install openssl` now fails: the index still names
openssl 1.1.1w-0+deb11u8 but deb.debian.org answers 404 for the file, so the
image cannot be built at all.
Moving only the runtime to bookworm would break the binaries: openssl-sys is in
the lock, so they link the system libssl, and a bullseye build wants libssl1.1,
which bookworm does not ship. Both stages move together: the builder becomes
rust:1.88-bookworm (the same toolchain ci-unified carried) and the runtime
bookworm-slim, so the binaries link the libssl3 they run with.
SatoshiQaziMuhammed