fix(wab): bump the Dockerfile bubblewrap pin to ~=0.12

[field123]

Every deploy from master currently fails at the Docker build:

RUN apk add --no-cache make~=4 bubblewrap~=0.11 ...
ERROR: unable to select packages:
  bubblewrap-0.12.0-r0: breaks: world[bubblewrap~0.11]

The base image node:24.16.0-alpine is pinned, but the Alpine package index it
installs from is not. That index now ships bubblewrap 0.12.0, and ~=0.11 means
>=0.11 <0.12, so the constraint can no longer be satisfied. Nothing in this repo
changed — the upstream index moved. The last successful deploy was 26 Aug.

This bumps the pin to ~=0.12 on both the builder and runner stages.

bubblewrap provides the bwrap sandbox that loader code execution runs inside, so it
cannot simply be unpinned or removed. Checked against the real base image: ~=0.12
installs, and all nine bwrap flags the sandbox passes (--clearenv, --setenv,
--unshare-user/-pid/-ipc/-uts/-cgroup, --ro-bind, --ro-bind-try) still exist in
0.12.0.

This is a stopgap. The underlying problem is that a floating package index makes the
build non-reproducible, so this will recur on the next upstream bump — worth pinning the
Alpine repository or base image digest separately.