feat(build): produce reproducible binaries and Docker images

[Starosdev]

Feature Request

Environment

• Affected: Both
• Component: Infrastructure

---

Description

Current builds are not reproducible — building from the same source commit on different machines or at different times may produce different binary hashes. Reproducible builds improve supply chain trust: users can verify a published binary matches what was built from source.

For Go binaries, reproducibility primarily requires:

• -trimpath flag to strip local file system paths from debug info
• SOURCE_DATE_EPOCH set to the commit timestamp for embedded time values
• Pinned, verified build toolchain versions

---

Technical Details

Location

• File: Makefile — add -trimpath to LD_FLAGS / build commands
• File: .github/workflows/release.yaml — set SOURCE_DATE_EPOCH from git commit
• File: docker/Dockerfile* — pin base image digests instead of floating tags

Current State

Makefile:26 sets -extldflags=-static but does not include -trimpath or SOURCE_DATE_EPOCH.

---

Acceptance Criteria

• Go binaries built with -trimpath
• SOURCE_DATE_EPOCH set to commit timestamp in CI release builds
• Docker base images pinned by digest in release Dockerfiles
• SHA256 checksums published alongside release binaries
• Two independent builds from same commit produce identical binary hashes