fix(docker): pin builder to bookworm to avoid glibc runtime mismatch

* fix(docker): pin builder to bookworm for glibc compatibility

* ci: skip rust lint on non-Rust PRs and allow 0BSD

* ci: pin actionlint action to existing release tag

* ci: make docs-only matcher shellcheck-clean

---------

Co-authored-by: chumyin <chumyin@users.noreply.github.com>

.github/workflows/workflow-sanity.yml

@@ -60,4 +60,4 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Lint GitHub workflows
-        uses: rhysd/actionlint@v1
+        uses: rhysd/actionlint@v1.7.11