feat: real Deno+Just container packaging (Containerfile)

[hyperpolymath]

Summary

• Nix was retired estate-wide 2026-06-01 (Guix is now primary, no Nix
  fallback). A bare flake.nix no longer satisfies the governance
  container-packaging gate; a sealed Containerfile is the accepted
  interim escape hatch. flake.nix is left in place here — the Guix
  side (guix.scm) isn't working for this repo yet.
• Replaces the prior stub Containerfile, which only had a commented-
  out example RUN line for the AffineScript build and pulled in
  nodejs — Node/npm are estate-banned; Deno is the sanctioned JS
  runtime. That stub also referenced artifact paths (selur,
  erlang-shipping-libs) that no real build step in the file produced.
• New Containerfile installs Deno and Just for real (wolfi-base
  apk packages) and runs genuine checks against the current tree in the
  build stage:
  • deno task check — the root deno.json "check" task. Its target
    glob (app/assets/javascripts/**/*.js) doesn't exist in this repo
    yet, so Deno reports "no matching files" and exits 0 — a real,
    honest pass reflecting current repo state, not a fake gate.
  • just test-structure (tests/validate_structure.sh)
  • just test-frontend-structure (tests/validate_frontend.sh)
  • just validate-rsr (RSR compliance file-presence check)
• deno.lock ships as an empty (0-byte) file in this repo, which Deno
  2.x treats as corrupt and refuses to run any command against. The
  build stage regenerates a minimal valid lockfile inside the image
  so the checks above can execute — the committed deno.lock in git is
  untouched by this PR.
• Runtime stage runs as non-root (USER nonroot, wolfi-base's built-in
  uid 65532 account); ENTRYPOINT ["just"] / CMD ["test-structure"].
• Scope note: candy-crash is a multi-language repo (Gleam backend,
  AffineScript/ReScript frontend, SPARK/Ada + Zig safety_core,
  VeriSimDB, Gossamer, Burble). This image packages the Deno + Just
  slice only, per this container-packaging task's mandate — it does not
  attempt to containerize the rest of the stack.

Verified build result

$ podman build -t candy-crash-verify:latest -f Containerfile .
...
Successfully tagged localhost/candy-crash-verify:latest
$ echo $?
0

podman run --rm candy-crash-verify:latest runs just test-structure
and exits 0 as the non-root user.

Test plan

• podman build -t candy-crash-verify:latest -f Containerfile . exits 0
• podman run --rm candy-crash-verify:latest exits 0
• Owner review of scope decision (Deno+Just only, not the full
  Gleam/AffineScript/SPARK stack)
• Owner decision on whether to fix the committed deno.lock /
  app/assets/javascripts glob mismatch in a follow-up

🤖 Generated with Claude Code