Add portable Linux packaging and verify distribution notices

deployment/Dockerfile

@@ -1,9 +1,19 @@
+# syntax=docker/dockerfile:1
+# Requires --build-context server_notices=<prepared server-notices directory>.
+# See docs/linux-packaging.md. Missing/stale notices fail before application build.
 FROM rust:1.90-bookworm AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends python3 \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY Cargo.toml Cargo.lock ./
+COPY LICENSE ./LICENSE
 COPY build ./build
 COPY crates ./crates
 COPY docs/openapi.json ./docs/openapi.json
+COPY scripts/package-artifacts.py ./scripts/package-artifacts.py
+COPY --from=server_notices / /tmp/server-notices/
+RUN python3 scripts/package-artifacts.py verify-notices \
+    --directory /tmp/server-notices --repository /src --target x86_64-unknown-linux-gnu
 RUN cargo build --release --locked -p oa-server
 
 FROM debian:bookworm-slim
@@ -12,6 +22,7 @@ RUN groupadd --gid 10001 arcadia \
     && mkdir /data \
     && chown 10001:10001 /data
 COPY --from=builder /src/target/release/arcadia-server /usr/local/bin/arcadia-server
+COPY --from=builder /tmp/server-notices/ /usr/share/doc/arcadia-server/
 USER 10001:10001
 VOLUME ["/data"]
 EXPOSE 8787

deployment/Dockerfile.dockerignore

@@ -1,9 +1,24 @@
-.git
-target
-dist
-harness
+# Only inputs consumed by this Dockerfile enter the ordinary repository context.
+# The server_notices named context is supplied separately and verified in builder.
+**
+!Cargo.toml
+!Cargo.lock
+!LICENSE
+!build/
+!build/**
+!crates/
+!crates/**
+!docs/
+!docs/openapi.json
+!scripts/
+!scripts/package-artifacts.py
+!deployment/
+!deployment/Dockerfile
+!deployment/Dockerfile.dockerignore
+# Do not admit generated/private files even inside an allowed source tree.
 **/target
-**/*.sqlite3
+**/.git
+**/.env
+**/.env.*
 **/*.log
-.codex
-.openai
+**/*.sqlite3