feat(docker): prepare portable images with runtime hotel configuration

src/lib/docker-build-contract.test.ts

@@ -42,3 +42,39 @@ it("passes a compiled release to both the application build and final image", ()
 	// biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose interpolation, not JavaScript.
 	expect(compose).toContain("NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}");
 });
+
+it("builds with fixtures and excludes installation secrets from every stage", () => {
+	const ignored = readFileSync(".dockerignore", "utf8");
+	expect(ignored).toMatch(/^\.env$/m);
+	expect(ignored).toMatch(/^\.env\.\*$/m);
+	expect(dockerfile).toContain("FROM migrations AS builder");
+	expect(dockerfile).toContain('HOTEL_NAME="Build fixture"');
+	expect(dockerfile).not.toMatch(
+		/^ENV.*(?:AUTH_SECRET|DATABASE_URL|HOTEL_NAME)/m,
+	);
+	expect(dockerfile).toContain('CMD ["node", "docker-start.mjs"]');
+	const updater = readFileSync("scripts/docker-update.sh", "utf8");
+	expect(updater).toContain("target=/app/.env,readonly");
+	expect(updater).toContain("--target migrations");
+});
+it("verifies portability before publishing and uses committed build context", () => {
+	const publish = readFileSync("scripts/publish-container.sh", "utf8");
+	expect(publish).toContain("git archive HEAD");
+	expect(
+		publish.indexOf("node scripts/verify-portable-image.mjs"),
+	).toBeLessThan(publish.indexOf("docker push"));
+	expect(publish).toContain("--password-stdin");
+	expect(publish).not.toContain(":latest");
+});
+
+it("does not prerender installation metadata into a shared image", () => {
+	for (const path of [
+		"src/app/robots.ts",
+		"src/app/sitemap.ts",
+		"src/app/manifest.ts",
+	]) {
+		expect(readFileSync(path, "utf8")).toContain(
+			'export const dynamic = "force-dynamic"',
+		);
+	}
+});