build: add reproducible Orbit container release

Dockerfile

@@ -0,0 +1,29 @@
+# syntax=docker/dockerfile:1.7
+
+ARG TARGETOS
+ARG TARGETARCH
+
+FROM golang:1.27.1-bookworm AS build
+
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+ENV GOWORK=off
+
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags='-s -w' -o /out/orbit ./cmd/orbit \
+    && CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags='-s -w' -o /out/orbit-migrate ./cmd/orbit-migrate \
+    && CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags='-s -w' -o /out/orbit-admin ./cmd/orbit-admin
+
+FROM scratch
+
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /out/orbit /usr/local/bin/orbit
+COPY --from=build /out/orbit-migrate /usr/local/bin/orbit-migrate
+COPY --from=build /out/orbit-admin /usr/local/bin/orbit-admin
+
+USER 65532:65532
+ENTRYPOINT ["/usr/local/bin/orbit"]