build: release a static image with scripts/release.sh

The image now packages a cross-compiled musl binary on distroless instead of
compiling inside Docker. The script builds it, pushes :<version> and :latest
to git.cosocial.info, and tags the commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -1,21 +1,12 @@
-# Debian release pinned on both stages so the binary's glibc matches at runtime.
-# The image tag pins the compiler, so rust-toolchain.toml (and its editor
-# components) is intentionally not copied in.
-FROM rust:1.91-slim-bookworm AS build
-WORKDIR /src
-COPY Cargo.toml Cargo.lock ./
-COPY src ./src
-RUN cargo build --release --bin cities-labeler
-
-FROM debian:bookworm-slim
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=build /src/target/release/cities-labeler /usr/local/bin/cities-labeler
+# Release image: packages the static binary built by scripts/release.sh.
+# No compiler runs here, so the image builds in seconds on any machine.
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY target/x86_64-unknown-linux-musl/release/cities-labeler /usr/local/bin/cities-labeler
 COPY data /app/data
 ENV CITIES_PATH=/app/data/cities.json \
     DB_PATH=/data/labeler.sqlite \
     PORT=4100
+# matches the owner of the ansible-managed data directory
 USER 1000:1000
 EXPOSE 4100
-CMD ["cities-labeler"]
+ENTRYPOINT ["/usr/local/bin/cities-labeler"]