dockerfile: scratch runtime for api-go, drop gcr.io

Switch from gcr.io/distroless/static-debian12:nonroot to FROM scratch.
CA certs, tzdata, /etc/passwd and /etc/group (nonroot uid/gid 65532)
are copied from the build stage.

api-go/Dockerfile

@@ -1,5 +1,7 @@
 # syntax=docker/dockerfile:1.7
 FROM golang:1.26-alpine AS build
+RUN apk add --no-cache ca-certificates tzdata
+RUN addgroup -g 65532 -S nonroot && adduser -u 65532 -S nonroot -G nonroot
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -10,8 +12,12 @@ RUN CGO_ENABLED=0 GOOS=linux \
     -ldflags "-s -w -X main.version=${VERSION}" \
     -o /out/bootnode ./cmd/bootnode
 
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM scratch
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=build /etc/passwd /etc/passwd
+COPY --from=build /etc/group /etc/group
 COPY --from=build /out/bootnode /usr/local/bin/bootnode
 EXPOSE 8000
-USER nonroot:nonroot
+USER 65532:65532
 ENTRYPOINT ["/usr/local/bin/bootnode"]