feat(wfe-server): full feature set, debian base, name resolution in gRPC

Proto changes:

* Add `name` to `WorkflowInstance`, `WorkflowSearchResult`,
  `RegisteredDefinition`, and `DefinitionSummary` messages.
* Add optional `name` override to `StartWorkflowRequest` and echo the
  assigned name back in `StartWorkflowResponse`.
* Document that `GetWorkflowRequest.workflow_id` accepts UUID or
  human name.

gRPC handler changes:

* `start_workflow` honors the optional name override and reads the
  instance back to return the assigned name to clients.
* `get_workflow` flows through `WorkflowHost::get_workflow`, which
  already falls back from UUID to name lookup.
* `stream_logs`, `watch_lifecycle`, and `search_logs` resolve
  name-or-UUID up front so the LogStore/lifecycle bus (keyed by
  UUID) subscribe to the right instance.
* `register_workflow` propagates the definition's display name into
  `RegisteredDefinition.name`.

Crate build changes:

* Enable the full executor feature set on wfe-yaml —
  `rustlang,buildkit,containerd,kubernetes,deno` — so the shipped
  binary recognizes every step type users can write.
* Dockerfile switched from `rust:alpine` to `rust:1-bookworm` +
  `debian:bookworm-slim` runtime. `deno_core` bundles a v8 binary
  that only ships glibc; alpine/musl can't link it without building
  v8 from source.

Dockerfile

@@ -1,7 +1,14 @@
 # Stage 1: Build
-FROM rust:alpine AS builder
+#
+# Using debian-slim (glibc) rather than alpine because deno_core's bundled v8
+# only ships glibc binaries — building v8 under musl from source is impractical
+# and we need the full feature set (rustlang, buildkit, containerd, kubernetes,
+# deno) compiled into wfe-server.
+FROM rust:1-bookworm AS builder
 
-RUN apk add --no-cache musl-dev protobuf-dev openssl-dev openssl-libs-static pkgconfig
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        protobuf-compiler libprotobuf-dev libssl-dev pkg-config ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 COPY . .
@@ -11,17 +18,19 @@ RUN mkdir -p .cargo && printf '[registries.sunbeam]\nindex = "sparse+https://src
 
 RUN cargo build --release --bin wfe-server \
     -p wfe-server \
-    --features "wfe-yaml/rustlang,wfe-yaml/buildkit,wfe-yaml/containerd,wfe-yaml/kubernetes" \
+    --features "wfe-yaml/rustlang,wfe-yaml/buildkit,wfe-yaml/containerd,wfe-yaml/kubernetes,wfe-yaml/deno" \
     && strip target/release/wfe-server
 
 # Stage 2: Runtime
-FROM alpine:3.21
+FROM debian:bookworm-slim
 
-RUN apk add --no-cache ca-certificates tini
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates tini libssl3 \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /build/target/release/wfe-server /usr/local/bin/wfe-server
 
-RUN adduser -D -u 1000 wfe
+RUN useradd -u 1000 -m wfe
 USER wfe
 
 EXPOSE 50051 8080