fix(pg-base): bump backup-image pg_dump to client 18, add --no-install-recommends

[sfreudenthaler]

The pg-base image exists to carry pg_dump for backup jobs. pg_dump can dump servers ≤ its own major and refuses newer — prod RDS is PG 15.15–15.17 today (verified across us-east-1/ca-central-1/eu-central-1/ap-southeast-2), so the current client-16 works only coincidentally; the repo fleet is already on PG18 and prod will follow. Client-18 handles all of it. Also applies the repo-standard --no-install-recommends to this last stray install (same class as #36806).

Verified: the exact new install line runs clean on ubuntu:24.04 and pg_dump --version reports 18.x (the image's own build-time self-check).

Closes: #36811

🤖 Generated with Claude Code

https://claude.ai/code/session_012ogYXVeZsBVUHkwzdStYPJ

[claude]

Claude finished @sfreudenthaler's task in 26s —— View job

---

PR Review: bump pg_dump to client 18

• Read the diff and full Dockerfile
• Reviewed for correctness, conventions, and risks

New Issues

No issues found.

The change is a clean two-part edit on docker/pg-base/Dockerfile:20:

1. postgresql-client-16 → postgresql-client-18 — correct for the stated goal. pg_dump refuses to dump a server newer than its own major but handles equal-or-older, so client-18 covers today's prod (PG 15.x) and the fleet's PG18. The apt.postgresql.org.sh PGDG repo (line 18) carries the postgresql-client-18 package, so the install resolves.
2. Added --no-install-recommends — matches the pattern already used on line 17 and the #36806 cleanup. Reduces the flattened scratch image (line 32–34) to just what pg_dump needs.

Points worth noting (non-blocking):

• The build-time self-check at docker/pg-base/Dockerfile:27 (pg_dump --version || exit 1) will fail the build if the package name/version ever stops resolving — good guard, and the PR body confirms it reports 18.x.
• The flags stay unpinned to a minor (postgresql-client-18, no exact version), consistent with the existing style — fine here since PGDG ships a single current 18 build and the scratch flatten captures whatever resolved at build time.

LGTM — approve. (Note: I can't submit a formal GitHub approval for security reasons; this is review feedback only.)