Add dune-pkg image variant with compiler variants

Split the pipeline into independent opam and dune-pkg paths over shared
helpers (Distro_util). Add an ocaml-base variant for `dune pkg` builds:
ships dune + a baked relocatable compiler, no opam/switch/repo. Scoped to
x86_64, apk/apt distros, OCaml >= 5.5. See docs/adr/0001, 0002.

On tier-1 distros also build compiler variants (+flambda, +afl,
+no-flat-float-array) via the upstream ocaml-options-only-* packages,
mirroring how the opam images install variants.

Author: frejsoya

builds.expected

@@ -0,0 +1,39 @@
+# Using a `dune` image
+
+Ships `dune` + a pre-built OCaml compiler baked into dune's cache. You bring a
+committed `dune.lock`; the image builds it, reusing the baked compiler — no opam,
+no network, no compiler rebuild.
+
+Tag: `ocaml/opam:<distro>-dune-ocaml-<version>[-<variant>]`, x86_64 only.
+E.g. `debian-dune-ocaml-5.5`, `alpine-dune-ocaml-5.5-flambda`.
+
+## On the host (once)
+
+`dune` must be installed. Lock from opam-repository only, so the locked compiler
+matches the baked one:
+
+```sh
+cat > dune-workspace <<'EOF'
+(lang dune 3.20)
+(lock_dir (repositories upstream))
+EOF
+
+dune pkg lock          # writes dune.lock/ — commit it; re-run only when deps change
+```
+
+## In the image
+
+```sh
+docker run --rm -v "$PWD:/src" -w /src \
+  ocaml/opam:debian-dune-ocaml-5.5 dune exec ./main.exe
+```
+
+Or `COPY . .` the sources in via a Dockerfile (the natural CI shape).
+
+## Gotchas
+
+- **Version/variant must match the tag.** A `dune-ocaml-5.5` image only reuses
+  the baked compiler if your lock resolves OCaml `5.5` (`(ocaml (= 5.5.0))`); a
+  `-flambda` image needs `ocaml-options-only-flambda` in your `depends`. A
+  mismatch forces a from-source compiler build.
+- **x86_64 only** — no dune Linux-arm64 binary.

doc/dune-pkg/USAGE.md

@@ -1,6 +1,9 @@
 (* For staging arch-specific builds before creating the manifest. *)
 let staging_repo = "ocurrent/opam-staging"
 
+(* dune-pkg staging images don't use the opam staging repo. *)
+let dune_staging_repo = "ocurrentbuilder/staging"
+
 let public_repo = "ocaml/opam"
 
 let password_path =

src/conf.ml

@@ -0,0 +1,36 @@
+(* Pure helpers shared by the opam and dune image pipelines. No OCurrent
+   dependency, so both [Pipeline_opam] and [Pipeline_dune] can use them without
+   either depending on the other. *)
+
+module Distro = Dockerfile_opam.Distro
+
+module Switch_map = Map.Make (Ocaml_version)
+module Windows_map = Map.Make (Distro)
+
+let or_die = function
+  | Ok x -> x
+  | Error (`Msg m) -> failwith m
+
+(* [aliases_of d] gives other tags which should point to [d].
+   e.g. just after the Ubuntu 20.04 release, [aliases_of ubuntu-20.04 = [ ubuntu; ubuntu-lts ]] *)
+let aliases_of =
+  let latest = Distro.distros |> List.map (fun d -> (Distro.resolve_alias d : Distro.distro :> Distro.t), d) in
+  fun d -> List.filter_map (fun (d2, alias) -> if d = d2 && d <> alias then Some alias else None) latest
+
+let master_distro = Distro.((resolve_alias master_distro : distro :> t))
+
+(* 2020-04-29: On Windows, squashing images is still experimental (broken). *)
+let squash distro =
+  Distro.os_family_of_distro distro <> `Windows
+
+(* 2022-07-18: Windows Containers don't support BuildKit.
+   https://github.com/microsoft/Windows-Containers/issues/34 *)
+let buildkit distro =
+  Distro.os_family_of_distro distro <> `Windows
+
+(* The set of all OCaml switches present across a list of per-arch maps. *)
+let all_switches arches =
+  let module Switch_set = Set.Make (Ocaml_version) in
+  arches |> ListLabels.fold_left ~init:Switch_set.empty ~f:(fun acc map ->
+      Switch_map.fold (fun k _v acc -> Switch_set.add k acc) map acc)
+  |> Switch_set.elements