feat(release): add verified image publication pipeline

Dockerfile

@@ -0,0 +1,26 @@
+# syntax=docker/dockerfile:1
+FROM ghcr.io/astral-sh/uv:0.11.14 AS uv
+FROM python:3.11-slim AS build
+ARG SOURCE_COMMIT
+WORKDIR /opt/portfolio-hub
+RUN test "${#SOURCE_COMMIT}" -eq 40 && case "${SOURCE_COMMIT}" in *[!0-9a-f]*) false;; *) true;; esac \
+    || { echo "SOURCE_COMMIT must be a 40-character lowercase commit" >&2; exit 1; }
+COPY --from=uv /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock README.md ./
+COPY app/ ./app/
+RUN uv sync --locked --no-dev --no-editable
+
+FROM python:3.11-slim AS runtime
+ARG SOURCE_COMMIT
+LABEL org.opencontainers.image.source="https://github.com/fourblocks2020/portfolio-hub" \
+      org.opencontainers.image.revision="${SOURCE_COMMIT}"
+RUN test "${#SOURCE_COMMIT}" -eq 40 && case "${SOURCE_COMMIT}" in *[!0-9a-f]*) false;; *) true;; esac \
+    && groupadd --gid 10001 portfoliohub \
+    && useradd --uid 10001 --gid 10001 --create-home --shell /usr/sbin/nologin portfoliohub \
+    || { echo "SOURCE_COMMIT must be a 40-character lowercase commit" >&2; exit 1; }
+WORKDIR /opt/portfolio-hub
+COPY --from=build /opt/portfolio-hub/.venv ./.venv
+ENV PATH="/opt/portfolio-hub/.venv/bin:${PATH}" PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
+USER 10001:10001
+EXPOSE 8000
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]