fix(docker): include z3 runtime in gateway image

[johntmyers]

Summary

Alternative fix for the gateway image smoke failure on PR #1528. The gateway binary links against system Z3, while the distroless gateway image does not include libz3.so.4. This PR keeps the existing artifact linkage and adds the matching Debian 13 Z3 runtime library to the gateway image.

This is intentionally different from commit 2d03367, which changes gateway artifacts to build with bundled-z3 and adds CI checks that reject shared libz3 linkage.

Related Issue

Refs #1528

Changes

• Add a Debian 13 package stage to Dockerfile.gateway that installs libz3-4.
• Copy only libz3.so.4 into the final distroless gateway runtime image.
• Document the libz3.so.4 image-smoke failure mode in the cluster debugging skill.

Testing

• cargo check -p openshell-server
• Built openshell/gateway:z3-runtime-test locally using the CI-built arm64 gateway binary from the failed image.
• docker run --rm --platform linux/arm64 openshell/gateway:z3-runtime-test --version
• mise run pre-commit not intentionally run per request. An accidental shell expansion while creating this PR ran part of pre-commit and failed in python:proto with missing grpc_tools.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 91d76b1. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.