fix(ci): build inside a Mandrel container to get a truly-static binary

The local native-image (GraalVM on Ubuntu jammy) produces a binary
linked against the runner's glibc 2.35. quarkus-micro-image:2.0 ships
glibc 2.34, hence the 'GLIBC_2.35 not found' runtime error.

binary-type=STATIC alone is not enough without musl on the build host.
-Dquarkus.native.container-build=true runs the native build inside the
Mandrel builder image, which ships musl and produces a genuinely static
binary that has no host-libc dependency.

Also adds a verification step that runs file and ldd on the runner
binary so the next CI log shows whether we actually shipped static.

.gitea/workflows/ci.yml

@@ -61,11 +61,20 @@ jobs:
           restore-keys: ${{ runner.os }}-node-
 
       - name: Build (Native)
-        run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC
+        run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC -Dquarkus.native.container-build=true
 
       - name: Verify native binary
         run: |
           ls -la target/shot-crafter-calculator-1.0.0-runner
+          echo "--- file ---"
+          file target/shot-crafter-calculator-1.0.0-runner
+          echo "--- ldd ---"
+          if ldd target/shot-crafter-calculator-1.0.0-runner >/dev/null 2>&1; then
+            echo "WARNING: binary has dynamic dependencies:"
+            ldd target/shot-crafter-calculator-1.0.0-runner
+          else
+            echo "OK: binary is statically linked (no dynamic dependencies)."
+          fi
 
       - name: Stage binary for Docker
         run: |