feat: Linux/cloud platform stack (TLS, registry, static/cross, selfhost PM)

Ship the QUALITY_PLAN platform focus: thin/minimal runtime, --static/--target,
Nexus HTTPS/mTLS with graceful stop, lock checksums + install --locked,
selfhost registry (search/add/HTTP), containers, and CI smokes for cloud path.

examples/docker/Dockerfile.alpine-health

@@ -0,0 +1,21 @@
+# Session 79 — Alpine multi-stage build of http_health with musl (when host
+# can run docker). The *builder* stage expects a prebuilt Linux binary
+# produced on Alpine or via musl-gcc:
+#
+#   # On Alpine / with musl-gcc:
+#   BUX_CC=musl-gcc BUX_RUNTIME=minimal ./buxc --static --release build …
+#   # or: ./tools/smoke_musl_static.sh
+#
+#   docker build -f examples/docker/Dockerfile.alpine-health -t bux-health-alpine .
+#
+# Fallback: copy a glibc binary and use debian (see Dockerfile.health).
+
+FROM alpine:3.20 AS runtime
+RUN apk add --no-cache ca-certificates
+WORKDIR /app
+# Prefer a static musl binary if present; else fail the build clearly.
+COPY build/http_health_musl /app/http_health
+ENV HEALTH_BIND=0.0.0.0
+ENV HEALTH_PORT=8080
+EXPOSE 8080
+ENTRYPOINT ["/app/http_health"]

examples/docker/Dockerfile.health

@@ -0,0 +1,18 @@
+# Session 78 — minimal health probe image (dynamic glibc + no OpenSSL needed if
+# linked without crypto... full runtime still needs libcrypto today).
+#
+# Build binary first:
+#   ./tools/build_health_bin.sh
+#   docker build -f examples/docker/Dockerfile.health -t bux-health .
+#   docker run --rm -p 8080:8080 bux-health
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY build/http_health /app/http_health
+ENV HEALTH_BIND=0.0.0.0
+ENV HEALTH_PORT=8080
+EXPOSE 8080
+ENTRYPOINT ["/app/http_health"]

examples/docker/Dockerfile.nexus

@@ -0,0 +1,26 @@
+# Session 78 — Nexus in a slim runtime image (dynamic link: pthread + OpenSSL).
+#
+# From repo root (after building apps/nexus/build/nexus on Linux):
+#   docker build -f examples/docker/Dockerfile.nexus -t bux-nexus .
+#   docker run --rm -p 8080:8080 bux-nexus
+#
+# HTTPS:
+#   docker run --rm -p 8443:8443 \
+#     -v $PWD/certs:/certs:ro \
+#     -e NEXUS_PORT=8443 -e NEXUS_TLS=1 \
+#     -e NEXUS_TLS_CERT=/certs/cert.pem -e NEXUS_TLS_KEY=/certs/key.pem \
+#     bux-nexus
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY apps/nexus/build/nexus /app/nexus
+COPY apps/nexus/public /app/public
+ENV NEXUS_BIND=0.0.0.0
+ENV NEXUS_PORT=8080
+ENV NEXUS_WORKERS=4
+ENV NEXUS_ACCESS_LOG=1
+EXPOSE 8080
+ENTRYPOINT ["/app/nexus"]

examples/docker/Dockerfile.static

@@ -0,0 +1,20 @@
+# Session 75 — fully-static Bux binary in a distroless/scratch container.
+#
+# Build (from repo root):
+#   # 1) produce a static host binary with the bootstrap compiler
+#   ./buxc --static --release build /path/to/pkg
+#   # or use the helper:
+#   ./tools/build_static_hello.sh
+#
+#   # 2) package it
+#   docker build -f examples/docker/Dockerfile.static \
+#     --build-arg BIN=build/hello_static \
+#     -t bux-hello-static .
+#
+# Run:
+#   docker run --rm bux-hello-static
+
+ARG BIN=build/hello_static
+FROM scratch
+COPY ${BIN} /app
+ENTRYPOINT ["/app"]