feat: add sealed Containerfile for Rust CLI (Nix retirement escape hatch)

[hyperpolymath]

Summary

• Nix was retired estate-wide on 2026-06-01. flake.nix no longer satisfies the governance container-packaging gate on its own for repos that have a real toolchain (Rust here); a sealed, buildable Containerfile is the accepted escape hatch.
• Adds a real, non-stub, two-stage Containerfile:
  • Builder: cgr.dev/chainguard/wolfi-base:latest, installs rust-1.89 (Wolfi's rust package bundles both rustc and cargo — there is no separate bare cargo package) + gcc, then runs cargo build --release -p invariant-path-cli (this repo's actual CLI binary crate; edition 2021 per Cargo.toml, no rust-toolchain.toml pin exists to honour instead).
  • Runtime: cgr.dev/chainguard/glibc-dynamic:latest, copies in the built binary, runs as USER nonroot, ENTRYPOINT ["/usr/bin/invariant-path-cli"].
• SPDX header is MPL-2.0, matching LICENSE, Cargo.toml, and every src/*.rs header in this repo (not the AGPL variant used on co-developed repos).
• flake.nix is left untouched — the Guix side isn't wired up yet, so removing it would leave no usable Nix-era dev environment for anyone still relying on it.

Verification (real, not asserted)

$ podman build -t invariant-path-verify:latest -f Containerfile .
...
Successfully tagged localhost/invariant-path-verify:latest
EXIT_CODE=0

$ podman run --rm invariant-path-verify:latest --help
Claim-path debugger overlay for repository artifacts
Usage: invariant-path-cli <COMMAND>
Commands:
  scan  annotations  overlay  profiles  doc-claims  help
RUN_EXIT=0

Both the build and a smoke-test run of the produced binary exit 0 with genuine CLI output, not a placeholder.

Note on branch contents

This branch also carries 2 pre-existing local commits (ebbd558, 3e0fd0e) that were ahead of origin/main before this work started and are unrelated to container packaging. Only the Containerfile commit (49d7f74) is new in this PR.

Test plan

• podman build -t invariant-path-verify:latest -f Containerfile . exits 0
• podman run --rm invariant-path-verify:latest --help prints real CLI help
• Maintainer confirms Containerfile satisfies the estate container-packaging governance gate

Generated with Claude Code