Add libffi 3.8.0 and Python 3.14.10 to debian13

Python is built from the python.org tarball against the pinned OpenSSL,
zlib, Zstd, SQLite and libffi; it does not pass --libdir because the
standard library and lib-dynload must stay under lib/python3.14. SQLite
is static, so its link flags are taken from pkg-config --static.
libffi is built with --disable-multi-os-directory so it installs into
the multiarch directory instead of lib/lib.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

debian13/Dockerfile

@@ -841,6 +841,28 @@ RUN --mount=type=bind,from=sources,source=freetds-1.5.21.tar.gz,target=/tmp/free
     && cd .. \
     && rm -rf src
 
+RUN --mount=type=bind,from=sources,source=libffi-3.8.0.tar.gz,target=/tmp/libffi.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/libffi.tar.gz --directory=src --strip-components=1 \
+    && cd src \
+    && CFLAGS="-O2 -fPIC" ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --disable-docs --disable-multi-os-directory \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
+RUN --mount=type=bind,from=sources,source=Python-3.14.10.tgz,target=/tmp/python.tgz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/python.tgz --directory=src --strip-components=1 \
+    && cd src \
+    && ./configure --prefix=${PREFIX} --with-ensurepip=install \
+        LIBSQLITE3_CFLAGS="$(pkg-config --cflags sqlite3)" \
+        LIBSQLITE3_LIBS="$(pkg-config --static --libs sqlite3)" \
+    && make --jobs="$(nproc)" \
+    && make install \
+    && cd .. \
+    && rm -rf src
+
 COPY source-stack.cmake.in /tmp/
 RUN mkdir -p ${PREFIX}/share/source-stack \
     && sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \