feat(container): Add comprehensive containerisation with Wolfi + Guix

- Add CONTAINERFILE with multi-stage build (builder, build, runtime, dev)
- Use Wolfi base image (Chainguard) for security-hardened containers
- Integrate Guix package manager for functional dependency management
- Configure Podman with SELinux labels and firewalld
- Add firewalld/ directory with:
  - firewalld.conf (DefaultZone=drop)
  - zones/drop.xml (explicit port allowances)
  - zones/public.xml (with rate limiting)
  - services/trigger-https.xml
  - services/trigger-api.xml
- Add selinux/ directory with:
  - selinux.config (enforcing mode)
  - policies/trigger.te (custom SELinux policy)
  - contexts/file_contexts
  - contexts/port_contexts
- Add scripts/git-hooks/ with:
  - pre-commit (format, lint, SPDX check)
  - pre-push (build, test, pons, panic-attack, container build)
  - post-commit (cleanup, documentation)
  - post-merge (rebuild, hook updates)
  - config.sh (hook configuration)
- Update ARCHITECTURE.adoc with containerisation section
- Security: All ports down except 80, 443, 8080, 8443, 22, 53
- Security: Non-root user, SELinux enforcing, firewalld drop zone

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

CONTAINERFILE

@@ -0,0 +1,382 @@
+# CONTAINERFILE for Trigger Application
+#
+# Multi-stage build for Podman/Docker using Wolfi base image with Guix
+#
+# Architecture: Ada/SPARK + Zig + Idris2
+# Target: x86_64 (can be extended for arm64)
+#
+# Build with:
+#   podman build -f CONTAINERFILE -t hyperpolymath/trigger:latest .
+#   podman run -it --security-opt label=type:container_runtime_t hyperpolymath/trigger:latest
+#
+# Security: Full SELinux labeling, firewalld integration, minimal privileges
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# =============================================================================
+# STAGE 1: Base Builder Image with Wolfi + Guix
+# =============================================================================
+
+FROM ghcr.io/wolfi-dev/wolfi:latest AS builder
+
+# Wolfi is a Chainguard-owned, community-driven Linux distribution
+# optimized for containers and cloud-native environments
+
+# Install system dependencies
+RUN apk add --no-cache \
+    # Build tools
+    gcc \
+    musl-dev \
+    make \
+    cmake \
+    git \
+    bash \
+    coreutils \
+    findutils \
+    diffutils \
+    gawk \
+    sed \
+    grep \
+    patch \
+    tar \
+    xz \
+    gzip \
+    bzip2 \
+    # Runtime dependencies
+    libsodium \
+    libgc \
+    libgmp \
+    # Container tools
+    podman \
+    buildah \
+    skopeo \
+    # Security
+    firewalld \
+    selinux-tools \
+    policycoreutils \
+    audit \
+    # Certificate management
+    ca-certificates \
+    openssl \
+    # Additional tools
+    curl \
+    wget \
+    jq \
+    python3 \
+    py3-pip \
+    # For Guix
+    guile \
+    gcc-gnat \
+    zig \
+    idris2 \
+    # For development
+    vim \
+    less \
+    tree \
+    htop \
+    lsof \
+    strace \
+    tcpdump \
+    net-tools \
+    iproute2 \
+    dnsutils \
+    # For CI/CD
+    just \
+    asciidoctor \
+    # For crypto
+    liboqs \
+    oqsproviders \
+    # Cleanup
+    && rm -rf /var/cache/apk/*
+
+# Set up Guix environment
+RUN mkdir -p /opt/guix && \
+    chown root:root /opt/guix && \
+    echo "export GUIX_PROFILE=/opt/guix/profile" >> /etc/profile.d/guix.sh && \
+    echo "export PATH=/opt/guix/profile/bin:$PATH" >> /etc/profile.d/guix.sh
+
+# Install Guix packages
+RUN source /etc/profile.d/guix.sh && \
+    guix pull --channels="guix.json" && \
+    guix install -p /opt/guix/profile \
+        gnat \
+        gprbuild \
+        asis \
+        spark \
+        zig \
+        idris2 \
+        libsodium \
+        liboqs \
+        openssl \
+        pkg-config \
+        autoconf \
+        automake \
+        libtool \
+        flex \
+        bison \
+        && guix gc
+
+# Set up build environment
+WORKDIR /app
+
+# Copy source code
+COPY . /app/
+
+# Configure build environment
+ENV GNAT_PROJECT_PATH=/app
+ENV ADA_INCLUDE_PATH=/app/src:/app/ffi
+ENV LD_LIBRARY_PATH=/opt/guix/profile/lib:$LD_LIBRARY_PATH
+
+# Install Ada dependencies via Alire (if available)
+RUN if command -v alr >/dev/null 2>&1; then \
+        alr update && \
+        alr get --build gnat_native \
+        gnatcoll \
+        aws \
+        sockets \
+        xmlada \
+        logging \
+        crypto; \
+    fi
+
+# =============================================================================
+# STAGE 2: Build Application
+# =============================================================================
+
+FROM builder AS build
+
+# Create build directory
+RUN mkdir -p /app/obj /app/bin /app/lib
+
+# Build with GNAT
+RUN echo "[BUILD] Building Trigger..." && \
+    gprbuild -P /app/trigger.gpr -XLIBRARY_TYPE=static && \
+    echo "[BUILD] GNAT compilation complete"
+
+# Build Zig FFI
+RUN echo "[BUILD] Compiling Zig FFI..." && \
+    cd /app/ffi/zig && \
+    zig build-lib -dynamic telegram.zig && \
+    zig build-lib -dynamic discord.zig && \
+    zig build-lib -dynamic twitter.zig && \
+    zig build-lib -dynamic crypto.zig -lc -lsodium -loqs && \
+    cd /app && \
+    echo "[BUILD] Zig compilation complete"
+
+# Build Idris2 API
+RUN echo "[BUILD] Compiling Idris2 API..." && \
+    cd /app/ffi/idris2 && \
+    idris2 --build TelegramAPI.ipkg && \
+    idris2 --build DiscordAPI.ipkg && \
+    idris2 --build TwitterAPI.ipkg && \
+    idris2 --build CryptoAPI.ipkg && \
+    cd /app && \
+    echo "[BUILD] Idris2 compilation complete"
+
+# =============================================================================
+# STAGE 3: Runtime Image
+# =============================================================================
+
+FROM ghcr.io/wolfi-dev/wolfi:latest AS runtime
+
+# Install runtime dependencies only
+RUN apk add --no-cache \
+    # Runtime
+    libsodium \
+    libgc \
+    libgmp \
+    # System
+    bash \
+    coreutils \
+    ca-certificates \
+    openssl \
+    # Security
+    firewalld \
+    selinux-tools \
+    policycoreutils \
+    audit \
+    # Tools
+    curl \
+    jq \
+    just \
+    # Crypto
+    liboqs \
+    oqsproviders \
+    && rm -rf /var/cache/apk/*
+
+# Set up Guix runtime
+RUN mkdir -p /opt/guix/profile && \
+    echo "export GUIX_PROFILE=/opt/guix/profile" >> /etc/profile.d/guix.sh && \
+    echo "export PATH=/opt/guix/profile/bin:$PATH" >> /etc/profile.d/guix.sh && \
+    echo "export LD_LIBRARY_PATH=/opt/guix/profile/lib:$LD_LIBRARY_PATH" >> /etc/profile.d/guix.sh
+
+# Install Guix runtime packages
+RUN source /etc/profile.d/guix.sh && \
+    guix pull --channels="guix.json" && \
+    guix install -p /opt/guix/profile \
+        libsodium \
+        liboqs \
+        openssl \
+    && guix gc
+
+# Set up directories
+RUN mkdir -p /app/bin /app/lib /app/obj /app/sessions /app/config /app/logs /app/cache && \
+    chmod 700 /app/sessions && \
+    chmod 700 /app/config && \
+    chmod 755 /app/logs && \
+    chmod 755 /app/cache
+
+# Copy built binaries from build stage
+COPY --from=build /app/bin/ /app/bin/
+COPY --from=build /app/lib/ /app/lib/
+
+# Copy runtime assets
+COPY .github/ /app/.github/
+COPY docs/ /app/docs/
+COPY LICENSE /app/LICENSE
+COPY LICENSES/ /app/LICENSES/
+COPY README.adoc /app/README.adoc
+COPY EXPLAINME.adoc /app/EXPLAINME.adoc
+COPY CONTRIBUTING.adoc /app/CONTRIBUTING.adoc
+COPY Justfile /app/Justfile
+
+# Set up firewalld configuration
+COPY firewalld/ /etc/firewalld/
+RUN chmod 640 /etc/firewalld/* && \
+    chown root:root /etc/firewalld/*
+
+# Set up SELinux context
+RUN chcon -R -t container_file_t /app && \
+    chcon -R -t httpd_sys_content_t /app/docs && \
+    chcon -R -t var_log_t /app/logs
+
+# Create non-root user for security
+RUN addgroup -S trigger && \
+    adduser -S -G trigger -D -s /bin/bash trigger && \
+    mkdir -p /home/trigger && \
+    chown trigger:trigger /home/trigger && \
+    chown -R trigger:trigger /app
+
+# Set up environment variables
+ENV APP_HOME=/app
+ENV APP_USER=trigger
+ENV APP_GROUP=trigger
+ENV APP_LOG_DIR=/app/logs
+ENV APP_CONFIG_DIR=/app/config
+ENV APP_CACHE_DIR=/app/cache
+ENV APP_SESSION_DIR=/app/sessions
+
+# Set capabilities (minimal)
+# Drop all capabilities by default, then add only what's needed
+RUN setcap -r /app/bin/trigger
+
+# Set SELinux security context
+LABEL maintainer=hyperpolymath
+LABEL version=1.0.0
+LABEL description="Trigger - Multi-platform social media reporting utility"
+LABEL security.txt="v=security.txt; contact=mailto:hyperpolymath@users.noreply.github.com"
+
+# Configure firewalld
+RUN firewall-offline-cmd --add-port=80/tcp && \
+    firewall-offline-cmd --add-port=443/tcp && \
+    firewall-offline-cmd --add-port=8080/tcp && \
+    firewall-offline-cmd --add-port=8443/tcp && \
+    firewall-offline-cmd --set-default-zone=drop && \
+    firewall-offline-cmd --add-service=ssh && \
+    firewall-offline-cmd --add-service=https && \
+    firewall-offline-cmd --add-service=dns
+
+# Set up SELinux policies
+RUN setsebool -P container_connect_any=1 && \
+    setsebool -P container_manage_cgroup=1 && \
+    setsebool -P httpd_can_network_connect=1 && \
+    setsebool -P httpd_can_network_relay=0 && \
+    setsebool -P nfs_export_all_rw=0
+
+# Set working directory
+WORKDIR /app
+
+# Set user to non-root for runtime
+USER trigger
+
+# Expose ports (only the ones we explicitly allow)
+EXPOSE 80/tcp
+EXPOSE 443/tcp
+EXPOSE 8080/tcp
+EXPOSE 8443/tcp
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD /app/bin/trigger --health || exit 1
+
+# Default command
+ENTRYPOINT ["/app/bin/trigger"]
+CMD ["--help"]
+
+# =============================================================================
+# STAGE 4: Development Container (with full toolchain)
+# =============================================================================
+
+FROM builder AS dev
+
+# Keep full build environment for development
+WORKDIR /app
+
+# Install development tools
+RUN apk add --no-cache \
+    git \
+    make \
+    cmake \
+    gdb \
+    valgrind \
+    clang \
+    llvm \
+    rust \
+    cargo \
+    go \
+    nodejs \
+    npm \
+    python3 \
+    py3-pip \
+    && rm -rf /var/cache/apk/*
+
+# Set up development environment
+ENV DEV_MODE=1
+ENV EDITOR=vim
+
+# Install Python packages for development
+RUN pip3 install --no-cache-dir \
+    pons \
+    panic-attack \
+    pygments \
+    black \
+    flake8 \
+    mypy \
+    pytest \
+    hypothesis
+
+# Set default command for development
+ENTRYPOINT ["/bin/bash"]
+CMD ["-c", "cd /app && just"]
+
+# =============================================================================
+# BUILD COMMANDS
+# =============================================================================
+
+# Build production image:
+#   podman build -f CONTAINERFILE -t hyperpolymath/trigger:latest .
+
+# Build development image:
+#   podman build -f CONTAINERFILE --target dev -t hyperpolymath/trigger:dev .
+
+# Run production container:
+#   podman run -it --rm --security-opt label=type:container_runtime_t \
+#       -p 80:80 -p 443:443 -p 8080:8080 -p 8443:8443 \
+#       --volume /path/to/config:/app/config:Z \
+#       --volume /path/to/sessions:/app/sessions:Z \
+#       hyperpolymath/trigger:latest
+
+# Run development container:
+#   podman run -it --rm --security-opt label=type:container_runtime_t \
+#       --volume $(pwd):/app:Z \
+#       hyperpolymath/trigger:dev