Docker image on GHCR (ghcr.io/datagriff/apic) #59

Why

CI systems that are not GitHub Actions (GitLab, Jenkins, Azure Pipelines) and locked-down runners install tools as images. A static binary makes a tiny scratch image, and the docs' CI recipes become one line.

What

• dockers: and docker_manifests: in .goreleaser.yaml: FROM scratch (plus ca-certificates copied in, since apic makes TLS calls), amd64 and arm64, tags latest, vX.Y.Z, vX.Y, ENTRYPOINT ["/apic"], WORKDIR /work, OCI labels (source, licence, description).
• release.yml: packages: write, docker/setup-qemu-action and docker/setup-buildx-action, login to GHCR with GITHUB_TOKEN.
• The image is signed with cosign keyless like checksums.txt (cosign sign ghcr.io/datagriff/apic@sha256:…), and docs/verifying.md gets the verify command.
• Docs: docker run --rm -v "$PWD/api:/work" ghcr.io/datagriff/apic run smoke.http --env staging --json --redact, with a note about APIC_VAR_* via -e and that apic ui needs -it.

Where

.goreleaser.yaml, .github/workflows/release.yml, a Dockerfile at the root, docs/getting-started.md, docs/cookbook.md (CI recipe variant), docs/verifying.md, README.md.

Tests

task snapshot builds the image locally (add --skip=publish); a CI smoke step runs docker run ghcr.io/datagriff/apic version after release.