feat(image): add scratch container image

Two-stage build producing a static /app on scratch; e2e tests for image contents, server and CLI through docker exec, socket handling, lifecycle and host/image parity.

dockerfile

@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2026 Bryan Joshua Pedini
+
+# Stage 1 · go builder
+ARG GO_BUILDER=golang
+ARG GO_VERSION=1.27.1-alpine
+FROM ${GO_BUILDER}:${GO_VERSION} AS build
+
+ARG GO_OS=linux
+ARG GO_ARCH=amd64
+ARG GIT_HOST
+ARG REPO_ORG
+ARG REPO_NAME
+ARG APP_VERSION=latest
+ARG COMMIT_ID=undefined
+
+# Copy the project inside the builder container
+WORKDIR $GOPATH/src/${GIT_HOST}/$REPO_ORG/$REPO_NAME/
+# Download the modules first, so they are cached across source changes
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+
+# Build the static binary (pure-Go SQLite, no cgo)
+RUN CGO_ENABLED=0 GOOS=${GO_OS} GOARCH=${GO_ARCH} \
+    go build \
+    -trimpath \
+    -ldflags="-w -s -X 'main.APP_VERSION=${APP_VERSION}' -X 'main.COMMIT_ID=${COMMIT_ID}'" \
+    -o /app .
+
+# Stage 2 · scratch image
+FROM scratch
+
+# Copy only the binary from the build stage
+COPY --from=build /app /app
+
+# Execute the binary
+ENTRYPOINT ["/app"]