build(docker): add the distroless image variant as a pilot

Publish pgsty/silo:<RELEASE>-distroless (and a rolling :distroless tag)
alongside the classic image: gcr.io/distroless/static-debian12 plus
exactly one program, the silo binary. No shell, no mc, no curl, no
entrypoint script - the binary is the ENTRYPOINT and the baked-in
exec-form HEALTHCHECK runs 'silo healthcheck ready'. The classic image
and its mc-based health checks are deliberately unchanged.
Design: silo.pgsty.com/compatibility/feature/healthcheck/

/data is created in the image layer, world-writable, because Docker
seeds fresh volumes from the layer mountpoint and no entrypoint exists
to repair ownership at runtime (issue #55); the parent directory is
copied from a throwaway busybox stage since COPY of a directory copies
contents rather than the entry itself, which would silently leave
/data at root:0755 and break every non-root run. The MINIO_USERNAME
drop-user path is not supported in this variant; use --user.

test-release.yml now builds the real Dockerfile.distroless on every
gate run (it has no download stages, so it stays offline) and asserts:
the HEALTHCHECK survives into the image config, /data ships 0777, no
shell and no /usr/bin/minio are present, Docker's health state turns
healthy from the baked probe alone, the probe binary execs without a
shell, and SIGTERM still stops the server gracefully - as root and as
--user 1001:1001. docker-release.yml gains the distroless build lanes,
multi-arch manifests, SBOM and provenance attestations, and a
release-blocking check that the pushed manifest still carries the
HEALTHCHECK (a Docker extension absent from the OCI image spec).

Verified locally on linux/arm64: full gate assertions plus bare
'docker run ... healthcheck' exit-code semantics and --version
passthrough.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

buildscripts/verify-rebrand.sh

@@ -35,6 +35,7 @@ for file in \
 	buildscripts/package/lifecycle_test.sh \
 	buildscripts/verify-helm-migration.sh \
 	Dockerfile.goreleaser \
+	Dockerfile.distroless \
 	dockerscripts/download-static-curl.sh \
 	dockerscripts/docker-entrypoint.sh \
 	helm/silo/Chart.yaml \
@@ -97,6 +98,9 @@ require_text Dockerfile.goreleaser "COPY silo /usr/bin/silo"
 require_text Dockerfile.goreleaser 'CMD ["silo"]'
 require_text Dockerfile.goreleaser "MC_AMD64_SHA256="
 require_text Dockerfile.goreleaser "Published checksum drift"
+require_text Dockerfile.distroless 'COPY --chmod=0755 silo /usr/bin/silo'
+require_text Dockerfile.distroless 'ENTRYPOINT ["/usr/bin/silo"]'
+require_text Dockerfile.distroless '"/usr/bin/silo", "healthcheck", "ready"'
 require_text dockerscripts/download-static-curl.sh "sha256sum -c"
 require_text helm/silo/Chart.yaml "name: silo"
 require_text helm/silo/values.yaml "repository: pgsty/silo"