Trim the debian, rhel, fedora and alpine runner images

[reaperhulk]

Applies the trimming from #791 and #792 to the other runner images.

Measured on x86_64:

Image	Before	After
bookworm	2.12 GB / 538 MB zstd	1.39 GB / 369 MB
alpine	2.49 GB / 652 MB zstd	1.03 GB / 267 MB
centos-stream9	1.76 GB / 450 MB zstd	1.16 GB / 307 MB
fedora	1.91 GB / 493 MB zstd	1.32 GB / 351 MB

trixie is 1.40 GB / 368 MB and sid 1.72 GB / 468 MB after (no baselines measured); sid's extra is Debian's gcc-16, whose cc1 is 240 MB vs 33 MB for gcc-14. centos-stream10 and the FIPS variants are 1.16–1.18 GB.

Everywhere, as in #792: keep only llvm-profdata and llvm-cov from llvm-tools-preview, symlink its duplicate libLLVM.so to rustc's, strip the big toolchain binaries with llvm-strip (before it is deleted), and drop rust-std's sanitizer runtimes and wasm-component-ld. rhel and fedora compare the libraries with sha256sum since their base images have no cmp.

Per image:

• debian: the Reduce the size of the ubuntu runner images #791 changes — gcc + libc6-dev instead of build-essential, --no-install-recommends (ca-certificates listed explicitly), and dpkg path-excludes for the static libpython/OpenSSL, gcc's LTO backend and the sanitizer runtimes.
• rhel: git-core instead of git (drops git-core-doc and ~60 perl packages), install_weak_deps=False, tsflags=nodocs, and gcc's lto1/lto-dump removed. The ubi8 branches are untouched.
• fedora: git-core, install_weak_deps=False (with python-unversioned-command kept explicitly since it was only a weak dep), lto1/lto-dump removed, and ~/.cargo/bin/rustup made a symlink to the packaged rustup-init instead of a 9 MB copy.
• alpine: on musl every llvm tool is statically linked, so the twelve unneeded tools alone were ~520 MB and the sanitizer runtimes 77 MB; the rust toolchain goes from 1.2 GB to 444 MB. Also removes python3-dev's 103 MB static libpython, lto1/lto-dump and the gcc sanitizer archives, and rust-lld, since rustc uses the system linker on musl (verified with --print link-args).

Verification:

• Ran the distros/alpine job steps from cryptography's ci.yml (vector fetch, pip install nox[uv], nox --install-only, the tests session, with OPENSSL_ENABLE_SHA1_SIGNATURES=1 as ci.yml sets it) in the new bookworm, alpine, centos-stream9, centos-stream10 and fedora images: all pass (4193–4647 passed depending on the OpenSSL), with llvm-profdata/llvm-cov writing the lcov file at 93.8–96.9% Rust line coverage.
• On every image including trixie, sid and both FIPS variants: forced from-source builds of cffi and coverage succeed with the C tracer importing, actions/checkout-style git operations work, cargo test including doctests passes, and a standalone -Cinstrument-coverage build goes through llvm-profdata and llvm-cov. The FIPS images show the FIPS policy active.
• bcrypt also runs its tests session in the alpine and ubuntu arm images; it needs nothing removed here.

Not changed: alpine's make (tiny, and I couldn't establish why it was added), Fedora's 59 MB of locale data (it's in the base image), and the aarch64 alpine variant couldn't be built locally, though the toolchain shell is the same host-agnostic logic that already passed CI on the ubuntu aarch64/armv7l/ppc64le builds.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LAX1TTcE6SPuzzGvGh4jdX

---

Generated by Claude Code