build(server): keep the Go symbol table in image builds (drop -s, keep -w)

[dvcdsys]

Companion to #151. That PR fixes the CLI; the server has the identical problem
and is not covered by it.

Why

Both server/Dockerfile and server/Dockerfile.cuda build with
-ldflags "-s -w". -s strips the Go symbol table, so a binary-mode
vulnerability scan of the published image cannot see which packages are
actually linked and falls back to module-level reporting — flagging advisories
for code that is not in the binary. This is exactly the effect that made
GO-2026-5932 (x/crypto/openpgp) look like a real finding on the CLI.

Measured on the server binary

build	size	symbols	govulncheck -mode=binary
-s -w (today)	24.0 MB	143	affected by 1 vulnerability from 1 module
-w (this PR)	25.7 MB	26 377	No vulnerabilities found

Cost: +6.8% on the binary (~1.7 MB), inside images of ~172 MB (CPU) and
~1.5 GB (CUDA) — noise at the image level. -w still strips DWARF, so debug
info is not shipped.

Notes

• No behaviour change; -X main.version= stamping is untouched.
• Worth landing together with build(cli): keep the Go symbol table in release binaries (drop -s, keep -w) #151 so both artifacts scan consistently —
  otherwise the CLI reports clean while the server keeps producing the same
  misleading module-level hits.
• Not tagged for release: this only takes effect on the next image build.

🤖 Generated with Claude Code