fix(container): install the protobuf well-known types in the build stage

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.

[yordis]

• The first publish canary image run on main failed: protoc could not resolve import "google/protobuf/timestamp.proto".
• Debian splits protoc and the include tree it resolves the well-known types against across two packages. CI installs protobuf-compiler without --no-install-recommends and picks the second one up implicitly; the Containerfile is the only place that passes that flag, so it was the only place that never got it.
• Without this, every green push to main leaves canary and the sha- rollback tag unpublished.