fix(ci): move the e2e base image to Debian bookworm

[sfc-gh-bnisco]

Why

CI is red on master and on every open pull request. Debian 11 bullseye reached the end of LTS support on 2026-08-31. The bullseye-security package pool no longer exists on deb.debian.org, so playwright install --with-deps fails and the e2e image build stops:

E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/x/xorg-server/xvfb_1.20.11-1+deb11u18_amd64.deb  404  Not Found
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
Failed to install browsers

61 packages return 404, all of them from debian-security. This breaks the four node_version=24.x jobs, because those are the only jobs that run e2e tests.

The error text moved over the last week. On 2026-09-10 apt reported Release file ... is expired. Debian republished that index on 2026-09-12 without a Valid-Until header, so the index loads again and the failure moved to the package files. The cause is the same, and it is permanent.

What

Move the e2e base image from python:3.13-slim-bullseye to python:3.13-slim-bookworm. Debian 12 bookworm keeps security support until 2028, and Playwright 1.48.0 supports it. The pinned Playwright version does not change.

Testing

Verified locally on linux/amd64:

• python:3.13-slim-bullseye fails the playwright install --with-deps step, as above.
• python:3.13-slim-bookworm builds the e2e_pip target for STREAMLIT_VERSION=latest (1.63.0) and STREAMLIT_VERSION=nightly (1.63.1.dev20260913).
• webkit 18.0, chromium 130.0.6723.31, and firefox 131.0 all launch and render a page in the built image.

The repo commits no screenshot snapshots, so the OS change carries no snapshot risk. The e2e tests assert on the DOM only.

Follow-ups, out of scope here

• Dockerfile declares ARG PYTHON_VERSION but never uses it. CI passes 3.10 and the image runs Python 3.13.
• playwright==1.48.0 is pinned in 7 places. That release is from October 2024.

🤖 Generated with Claude Code