feat: add sealed Containerfile (Nix-retirement escape hatch)

[hyperpolymath]

Summary

• Nix was retired estate-wide 2026-06-01, so a bare flake.nix no longer satisfies the governance CI gate. This adds a sealed, real Containerfile at the repo root as the accepted escape hatch — every RUN line is active (no commented examples, no # TODO: placeholders, no || true fake gates).
• Toolchain scope was measured, not guessed: this repo is overwhelmingly a Just-orchestrated spec/docs/governance tree (127 .adoc, 118 .a2ml, 32 .yml, 20 .sh, vs. only 9 .idr and zero real, non-template .zig). The Containerfile provisions and genuinely exercises that bulk toolchain: just, bash, git, and GNU coreutils/findutils/grep/gawk/sed (busybox's find lacks -printf, which scripts/check-root-shape.sh needs).
• Real active build step: RUN just --list --unsorted > /dev/null — a genuine smoke test that fails the build if the Justfile stops parsing under the provisioned toolchain.
• Two-stage build (Wolfi build stage → Wolfi runtime stage, USER nonroot), following the estate house style (see aerie/Containerfile, proven-servers/Containerfile).
• ENTRYPOINT ["just"] / CMD ["--list", "--unsorted"] — running the image lists the repo's Just recipes, which is the genuinely useful thing this container can do (there is no compiled service binary in this repo).

Deliberate, documented exclusions (not stubs)

• Idris2 is intentionally NOT provisioned. abi.ipkg + src/interface/Abi/{Types,Layout,Foreign}.idr are real, valid Idris2 with real ABI/layout proofs — but there is no Wolfi/Alpine idris2 package, and the only install path (idris2-pack) itself requires a pre-installed Chez Scheme or Racket, neither of which has a Wolfi/Alpine package either. I confirmed this by hand: building Chez Scheme from source in a Wolfi container is the only remaining path, and it's a 10-30+ minute, fragile compile to serve 9 files out of a ~300-file tree — disproportionate for this container. The header comment documents this and points contributors who need the ABI proofs at upstream pack / idris2 --typecheck abi.ipkg on a host that already has Scheme.
• The Zig FFI side is out of scope too. src/interface/ffi/ is still the RSR template's uninstantiated scaffold: main.zig keeps the template's literal {{project}} placeholders (not valid Zig identifiers), and build.zig deliberately wires up no build/test steps yet.

Verification

$ podman build -t contractiles-verify:latest -f Containerfile .
...
Successfully tagged localhost/contractiles-verify:latest
EXIT_CODE=0

Also ran podman run --rm contractiles-verify:latest, which correctly lists the Justfile's recipes.

flake.nix is untouched — Guix is not yet a working dev environment for this repo, so the Nix fallback needs to stay usable.

Test plan

• podman build -t contractiles-verify:latest -f Containerfile . exits 0
• podman run --rm contractiles-verify:latest lists Just recipes correctly
• Maintainer confirms the toolchain scope (Just-only, no Idris2/Zig) matches intent for this repo

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE