Image rebuilds get the newest base image

A build FROM python:3.12-slim or :latest now starts from the image the tag names today, as docker buildx build does, instead of an earlier pull kept from a past build. cache: false (--no-cache) now always builds every step afresh. See Faster rebuilds.