build(docker): ship the silo binary and translate the legacy argv command

Dockerfile.goreleaser now copies silo to /usr/bin/silo, defaults to
CMD ["silo"], and labels the image as Silo. MINIO_UPDATE_MINISIGN_PUBKEY is
removed from the image environment: with the updater permanently disabled it
was dead weight, and leaving upstream's verification key in a Silo image
implied a trust relationship that does not exist. The MINIO_* runtime
environment variables, ports, volume and health endpoints are unchanged.

The image keeps shipping mcli with an /usr/bin/mc symlink. That is the client,
not a MinIO-branded alias for the server binary, and the Helm post-install job
and existing container scripts call it by name.

docker-entrypoint.sh translates a legacy first argument: `minio server /data`
becomes `silo server /data`, so an existing `command: minio server ...` in
compose or a Pod spec keeps working across the image swap. The translation is
argv-level only - no file named minio is installed, and an explicitly
overridden `entrypoint: /usr/bin/minio` still fails, which is the honest
outcome since that path genuinely no longer exists.

The entrypoint also fixes an unrelated startup hazard it was already carrying:
when the image runs under an arbitrary UID, HOME points at an unreadable /root
and the server probes its default config directory during initialization. It
now falls back to /tmp when HOME is unset, /root, missing or unwritable.

docker-entrypoint_test.sh pins all of it - empty argv, legacy minio, native
silo, bare flags, and an explicit shell command that must stay explicit. It is
wired into make rebrand-guard and into the go.yml, release.yml and
test-release.yml gates, so removing the shim breaks CI rather than breaking
users. Passing locally.

download-static-curl.sh gains checksum verification for the curl it fetches
into the build stage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

dockerscripts/download-static-curl.sh

@@ -4,21 +4,23 @@
 # v8.17.0 (current latest) dropped the aarch64 build.
 STATIC_CURL_VERSION="v8.11.0"
 
-function download_arch_specific_executable {
-	curl -f -L -s -q \
-		"https://github.com/moparisthebest/static-curl/releases/download/${STATIC_CURL_VERSION}/curl-$1" \
-		-o /go/bin/curl || exit 1
-	chmod +x /go/bin/curl
-}
-
-case $TARGETARCH in
-"arm64")
-	download_arch_specific_executable aarch64
+case ${TARGETARCH:?TARGETARCH is required} in
+amd64)
+	asset=curl-amd64
+	expected=d18aa1f4e03b50b649491ca2c401cd8c5e89e72be91ff758952ad2ab5a83135d
 	;;
-"s390x")
-	echo "Not downloading static cURL because it does not exist for the $TARGETARCH architecture."
+arm64)
+	asset=curl-aarch64
+	expected=1b050abd1669f9a2ac29b34eb022cdeafb271dce5a4fb57d8ef8fadff6d7be1f
 	;;
 *)
-	download_arch_specific_executable "$TARGETARCH"
+	echo "Unsupported static cURL architecture: ${TARGETARCH}" >&2
+	exit 1
 	;;
 esac
+
+curl --fail --location --silent --show-error --retry 3 \
+	"https://github.com/moparisthebest/static-curl/releases/download/${STATIC_CURL_VERSION}/${asset}" \
+	--output /go/bin/curl
+printf '%s  %s\n' "${expected}" /go/bin/curl | sha256sum -c
+chmod +x /go/bin/curl