fix(docker): provide z3 for CLI-building Dockerfiles

The openshell-prover crate depends on z3. For Linux-targeted builds
(python-wheels), install libz3-dev to link against the system library.
For macOS cross-compilation (python-wheels-macos, cli-macos), compile
z3 from source via the bundled-z3 feature since system libz3-dev only
provides a Linux .so, not a macOS .dylib.

Add a bundled-z3 forwarding feature to openshell-cli so both cargo and
maturin can activate it uniformly.

Author: johntmyers

crates/openshell-cli/Cargo.toml

@@ -76,6 +76,7 @@ tracing-subscriber = { workspace = true }
 workspace = true
 
 [features]
+bundled-z3 = ["openshell-prover/bundled-z3"]
 dev-settings = ["openshell-core/dev-settings"]
 
 [dev-dependencies]

deploy/docker/Dockerfile.cli-macos

@@ -88,7 +88,7 @@ RUN mkdir -p crates/openshell-cli/src \
 RUN --mount=type=cache,id=cargo-registry-cli-macos,sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-cli-macos,sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-cli-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
-    cargo build --release --target aarch64-apple-darwin -p openshell-cli 2>/dev/null || true
+    cargo build --release --target aarch64-apple-darwin -p openshell-cli --features bundled-z3 2>/dev/null || true
 
 # ---------------------------------------------------------------------------
 # Stage 2: real build
@@ -116,7 +116,7 @@ RUN --mount=type=cache,id=cargo-registry-cli-macos,sharing=locked,target=/root/.
     if [ -n "${OPENSHELL_CARGO_VERSION:-}" ]; then \
       sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${OPENSHELL_CARGO_VERSION}"'"/}' Cargo.toml; \
     fi && \
-    cargo build --release --target aarch64-apple-darwin -p openshell-cli && \
+    cargo build --release --target aarch64-apple-darwin -p openshell-cli --features bundled-z3 && \
     cp target/aarch64-apple-darwin/release/openshell /openshell
 
 FROM scratch AS binary

deploy/docker/Dockerfile.python-wheels

@@ -15,6 +15,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     gcc \
     libc6-dev \
+    libz3-dev \
     pkg-config \
     libssl-dev \
     && rm -rf /var/lib/apt/lists/*

deploy/docker/Dockerfile.python-wheels-macos

@@ -23,6 +23,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ca-certificates \
     clang \
+    cmake \
     curl \
     libssl-dev \
     pkg-config \
@@ -78,7 +79,7 @@ RUN mkdir -p crates/openshell-cli/src crates/openshell-core/src crates/openshell
 RUN --mount=type=cache,id=cargo-registry-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-python-wheels-macos-${TARGETARCH}-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
-    cargo build --release --target aarch64-apple-darwin -p openshell-cli 2>/dev/null || true
+    cargo build --release --target aarch64-apple-darwin -p openshell-cli --features bundled-z3 2>/dev/null || true
 
 # Copy actual source code and Python packaging files.
 COPY crates/ crates/
@@ -109,7 +110,7 @@ RUN --mount=type=cache,id=cargo-registry-python-wheels-macos-${TARGETARCH},shari
     if [ -n "${OPENSHELL_CARGO_VERSION:-}" ]; then \
       sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${OPENSHELL_CARGO_VERSION}"'"/}' Cargo.toml; \
     fi && \
-    maturin build --release --target aarch64-apple-darwin --out /wheels
+    maturin build --release --target aarch64-apple-darwin --features bundled-z3 --out /wheels
 
 FROM scratch AS wheels
 COPY --from=builder /wheels/*.whl /