Phase 5: scaffold Crucible (sow-tools) — dispatcher + builder shims, container, PR-first CI, fail-closed (D11, D19).

docker/Dockerfile

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1
+#
+# Crucible toolchain image: registry.westgate.pw/sow/crucible:<git-sha>
+#
+# Reproducible multi-stage build, no on-VPS build. Produces every cmd/* binary
+# and ships them on a static base. The `crucible` dispatcher is the entrypoint;
+# consumer CI can also call the standalone crucible-<name> binaries by path.
+#
+# NOTE (Phase 5 scaffold): the binaries are pure stdlib and fail closed until
+# the operator migrates the internal pipeline. When the music pipeline is wired
+# it needs ffmpeg at runtime — switch the final stage to a debian-slim base with
+# ffmpeg then (see docs/migration-from-nwn-tool.md).
+
+FROM golang:1.26-alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+# go.sum is optional while the scaffold has no external deps.
+COPY go.mod go.sum* ./
+RUN go mod download
+COPY . .
+ARG GIT_SHA=unknown
+ENV CGO_ENABLED=0
+RUN set -eux; \
+    mkdir -p /out; \
+    for dir in ./cmd/*/; do \
+      name="$(basename "${dir}")"; \
+      go build -trimpath \
+        -ldflags "-s -w -X gitea.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${GIT_SHA}" \
+        -o "/out/${name}" "${dir}"; \
+    done
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/ /usr/local/bin/
+USER nonroot
+ENTRYPOINT ["/usr/local/bin/crucible"]
+CMD ["help"]