feat: add a minimal runtime image - #187

The shell-hook example uses Ubuntu for the final stage even though it only needs to run an already-installed environment. This adds ghcr.io/prefix-dev/conda-runtime:glibc-bash, a scratch image with glibc, Bash, and their runtime libraries, without Pixi or a package manager.

I used selected files from a digest-pinned Wolfi image rather than complete APK packages to keep the base small. Local uncompressed sizes are 7.77 MB on amd64 and 7.17 MB on arm64, compared with 78.16 MB for Ubuntu 24.04 on amd64. The image retains upstream component SBOMs, source-path/package mappings, and checksums of the extracted files. These are source-package SBOMs, not an inventory of complete installed APKs or the application's conda environment.

The README and example use the new image. A separate workflow tests both architectures on native runners, exports the tested images, and publishes them as glibc-bash and glibc-bash-<full-git-commit> on main, independently of Pixi releases. Branch-scoped concurrency prevents older runs from overwriting the floating tag. The image has no /bin/sh, coreutils, terminfo, or system CA bundle; the README explains when to include dependencies in the environment or keep using Ubuntu/Debian.

libgcc_s is not included in the base. Applications that need it for glibc thread cancellation or pthread_exit must obtain a discoverable copy from their environment.

Image naming

The runtime goes to a separate conda-runtime package rather than a runtime tag on the pixi package, because this image contains no Pixi and runs any copied conda environment, whatever installed it. The glibc-bash tag names the runtime components it provides, so the name does not commit us to Wolfi as the source distribution.

The new GHCR package needs public visibility after its first publication.

Both final stages stay supported, so the README has a "Choosing a final base image" table comparing conda-runtime and ubuntu:24.04 on size, attack surface, in-container debugging, CA bundles, and base updates. Short version: conda-runtime for small production images where the environment carries everything, Ubuntu or Debian when you want a shell and system packages for debugging or for tooling that expects a distribution layout.

Testing

• Built and ran the existing example on linux/amd64 and linux/arm64 locally; ARM64 ran under Docker Desktop emulation.
• Checked shell-hook execution as PID 1, user/group lookup, UTF-8 locale, SQLite, HTTPS, native pthread_exit using the environment's libgcc_s, and file/SBOM provenance with a read-only root filesystem as UID/GID 65532.
• Exercised the default four-worker Gunicorn command, HTTP responses, worker replacement on SIGHUP, and clean shutdown through Docker SIGTERM on both architectures during the initial runtime implementation.
• Passed pixi exec --spec actionlint --spec shellcheck actionlint .github/workflows/runtime.yml.
• Verified the publication commands against a temporary local registry: exported and reloaded both tested images, pushed the per-architecture tags, and assembled the multi-platform manifest. Both published platform configs matched the tested image IDs exactly.

GHCR publication has not been exercised. The separate Pixi deployment guide's Ubuntu example remains valid and is unchanged.