Install tzdata-legacy in the Gitaly image

What does this MR do?

Adds tzdata-legacy to the runtime apt-get install list in gitaly/Dockerfile, with a short comment explaining why. This matches the existing tzdata-legacy install in gitlab-rails/Dockerfile.erb.

Since CNG 19.4 moved Debian images from bookworm to trixie (!3052 (merged)), legacy IANA timezone names (Israel, Europe/Kiev, US/Eastern, Asia/Calcutta, etc.) moved out of tzdata into tzdata-legacy. That MR updated the GitLab Rails image but missed Gitaly. Without the legacy zone data, Gitaly's Go runtime fails to resolve these timezone names with unknown time zone <name>, which GitLab Rails surfaces as a false merge-conflict when merging, updating a merge ref, squashing, or creating a web commit for a user whose profile timezone is a legacy name.

Test plan

In the unmodified gitaly:v19.4.1 image (root):

apt-get install --no-install-recommends tzdata-legacy

installs tzdata-legacy 2026c-0+deb13u1, the same version as the installed tzdata.

Before this install, a Go program calling time.LoadLocation fails for Israel, Europe/Kiev, US/Eastern, and Asia/Calcutta with unknown time zone. After the install, all four resolve successfully.

Separately, calling UserMergeToRef from GitLab Rails against the unmodified gitaly:v19.4.1 fails with InvalidArgument: unknown time zone Israel / Europe/Kiev.

Conditions for success on the image built by this MR:

ls /usr/share/zoneinfo/Israel /usr/share/zoneinfo/Europe/Kiev

Both paths must exist in the Gitaly image.

Result: passed. In the Gitaly image built by pipeline https://gitlab.com/gitlab-org/build/CNG/-/pipelines/2888575847 (registry.gitlab.com/gitlab-org/build/cng/gitaly:958e646607f9d546be6495c6b820b356f20075a4), both paths exist and tzdata-legacy 2026c-0+deb13u1 is installed.

Size impact: tzdata-legacy adds about 1.2 MB (Installed-Size 1251 KB).

Related issues

Closes #2427 (closed)

• GitLab issue: gitlab-org/gitlab#630996 (closed)
• Earlier related issue: gitlab-org/gitlab#571698
• GitLab Rails defense-in-depth fix (translates legacy names to canonical before calling Gitaly): gitlab-org/gitlab!257897 (merged)
• CNG trixie upgrade that introduced the regression: !3052 (merged)
• Linux package Docker image already installs tzdata-legacy: gitlab-org/omnibus-gitlab!8759 (merged)

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

• Merge Request Title, and Description are up to date, accurate, and descriptive
• MR targeting the appropriate branch
• MR has a green pipeline on GitLab.com
• When ready for review, MR is labeled "~workflow::ready for review" per the Distribution MR workflow

Expected (please provide an explanation if not completing)

• Test plan indicating conditions for success has been posted and passes
• Documentation created/updated
• Integration tests added to GitLab QA
• The impact any change in container size has should be evaluated
• New dependencies are managed with GitLab forked renovatebot

Checklist notes:

• FIPS/UBI: fips_pipeline and ubi_pipeline were not run. The change only touches the Debian gitaly/Dockerfile; the UBI builds use gitaly/Dockerfile.ubi and RHEL tzdata, which already ships the legacy names.
• Documentation: not needed. This is a package-only change to the image; no user-facing configuration changes.
• QA integration test: not added. The reproduction against GitLab Rails (UserMergeToRef) above covers the real-world path; the test plan's ls check covers the image-level condition for success.
• Renovate: not applicable. tzdata-legacy is a Debian package pulled from the base image's apt repo, the same way tzdata already is; it is not a renovate-managed dependency.