fix(iso): auto-detect and install kernel headers at build time

- Dockerfile: linux-headers-amd64 meta-package instead of pinned ABI;
  remove DEBIAN_KERNEL_ABI build-arg (no longer needed at image build time)
- build-in-container.sh: drop --build-arg DEBIAN_KERNEL_ABI
- build.sh: apt-get update + detect ABI from apt-cache at build time;
  auto-install linux-headers-<ABI> if kernel changed since image build

Image rebuild is now needed only when changing Go version or lb tools,
not on every Debian kernel point release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build-in-container.sh

@@ -59,7 +59,6 @@ IMAGE_REF="${IMAGE_TAG}:debian${DEBIAN_VERSION}"
 if [ "$REBUILD_IMAGE" = "1" ] || ! "$CONTAINER_TOOL" image inspect "${IMAGE_REF}" >/dev/null 2>&1; then
     "$CONTAINER_TOOL" build \
         --build-arg GO_VERSION="${GO_VERSION}" \
-        --build-arg DEBIAN_KERNEL_ABI="${DEBIAN_KERNEL_ABI}" \
         -t "${IMAGE_REF}" \
         "${BUILDER_DIR}"
 else