fix(container): repair Containerfile build rot + add runtime.exs for env config

The container/Containerfile build was broken end-to-end; six fixes make
`podman build -f container/Containerfile` succeed and produce a runnable REST image:

1. .dockerignore excluded scripts/fetch-cartridges.sh (needed by COPY) and
   schemas/cartridge-v1.json (Catalog schema mirror) — un-ignored both.
2. Pin Zig to 0.15.1 (.tool-versions) instead of unpinned `apk add zig`, which
   pulled a newer Zig that removed std.heap.GeneralPurposeAllocator.
3. Elixir builder cgr.dev/chainguard/elixir:latest is now 403/auth-gated →
   public docker.io/elixir:1.18.4-otp-25.
4. Runtime base cgr.dev/chainguard/wolfi-base lost gcompat/ncurses-libs and its
   OpenSSL 3 breaks the OTP-25 crypto NIF (needs libcrypto.so.1.1) →
   debian:bullseye-slim (matches builder ABI).
5. COPY schemas/cartridge-v1.json into /schemas (Catalog requires it at boot).
6. Strip multi-GB .zig-cache from the cartridge tree before the runtime COPY
   (was exhausting build disk).

Plus config/runtime.exs so BOJ_PORT / BOJ_BIND_IP / BOJ_CARTRIDGES_ROOT are read
at release boot, not baked at compile time — fixes the listener binding to
127.0.0.1 (unreachable via port-map) and cartridges_loaded:0 (baked build-path).

Deployed and verified live on Hetzner: /health returns 200.

Refs #271, #272.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.dockerignore

@@ -83,3 +83,5 @@ data/
 configs/
 k8s/
 setup.sh
+!scripts/fetch-cartridges.sh
+!schemas/cartridge-v1.json

container/Containerfile

@@ -24,7 +24,11 @@ ARG BOJ_CARTRIDGES_REPO=https://github.com/hyperpolymath/boj-server-cartridges.g
 
 FROM cgr.dev/chainguard/wolfi-base:latest AS zig-builder
 
-RUN apk add --no-cache zig build-base git bash
+RUN apk add --no-cache build-base git bash curl xz
+# Pin Zig to the repo-declared version (.tool-versions: 0.15.1); wolfi apk zig rolls forward and breaks the build
+RUN curl -fsSL https://ziglang.org/download/0.15.1/zig-x86_64-linux-0.15.1.tar.xz -o /tmp/zig.tar.xz \
+    && mkdir -p /opt/zig && tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1
+ENV PATH=/opt/zig:${PATH}
 
 WORKDIR /build
 
@@ -59,7 +63,10 @@ RUN for ffi_dir in /build/cartridges/*/ffi; do \
 # Stage 2: Elixir Release Builder
 # ============================================================================
 
-FROM cgr.dev/chainguard/elixir:latest AS mix-builder
+# Strip Zig build caches (multi-GB, runtime-irrelevant) so the cartridge COPY into the runtime stage stays small
+RUN find /build/cartridges -type d -name .zig-cache -prune -exec rm -rf {} + 2>/dev/null || true
+
+FROM docker.io/elixir:1.18.4-otp-25 AS mix-builder
 
 WORKDIR /build
 
@@ -77,7 +84,7 @@ RUN mix release boj_rest
 # Stage 3: Runtime Image
 # ============================================================================
 
-FROM cgr.dev/chainguard/wolfi-base:latest
+FROM docker.io/debian:bullseye-slim
 
 # OCI labels
 LABEL org.opencontainers.image.title="Bundle of Joy Server" \
@@ -90,10 +97,10 @@ LABEL org.opencontainers.image.title="Bundle of Joy Server" \
       dev.stapeln.compose="container/compose.toml"
 
 # Minimal runtime deps: OpenSSL (Elixir TLS), ncurses (Erlang), glibc (boj-invoke + .so)
-RUN apk add --no-cache ca-certificates openssl ncurses-libs libstdc++ gcompat
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates openssl libncurses6 libstdc++6 && rm -rf /var/lib/apt/lists/*
 
 # Non-root user
-RUN addgroup -S appuser && adduser -S appuser -G appuser
+RUN groupadd -r appuser && useradd -r -g appuser -d /app appuser
 
 WORKDIR /app
 
@@ -144,6 +151,9 @@ ENV PORT=7700
 ENV MIX_ENV=prod
 
 VOLUME ["/data"]
+# Cartridge schema mirror (Catalog validates cartridges against /schemas/cartridge-v1.json)
+COPY schemas/cartridge-v1.json /schemas/cartridge-v1.json
+
 USER appuser
 
 EXPOSE 7700

elixir/config/runtime.exs

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+import Config
+
+# Runtime configuration — evaluated at release BOOT, not compile time. Without this,
+# a `mix release` bakes config.exs's env lookups at build time, so BOJ_BIND_IP /
+# BOJ_PORT / BOJ_CARTRIDGES_ROOT set at `podman run` are ignored (the release keeps
+# the build-time values: bind 127.0.0.1 unreachable via port-map, and a build-path
+# cartridges_root that yields cartridges_loaded:0). Re-reading them here fixes both.
+config :boj_rest,
+  port: String.to_integer(System.get_env("BOJ_PORT") || "7700"),
+  bind_ip: System.get_env("BOJ_BIND_IP") || "127.0.0.1",
+  cartridges_root:
+    System.get_env("BOJ_CARTRIDGES_ROOT") ||
+      System.get_env("BOJ_CARTRIDGES_PATH") ||
+      Path.expand("../../cartridges", __DIR__),
+  data_dir: System.get_env("BOJ_DATA_DIR") || "/data"