Add Makefile and bin/ scripts for one-command multi-arch release

make release builds, smoke-tests and pushes amd64 (on fsn1app1 via
DOCKER_HOST) and arm64 (local), joins them into latest and dated
multi-arch manifests, and commits the day's logs. Logic lives in bin/;
the Makefile only wires dependencies so -j2 runs the arches in parallel.

README.md

@@ -131,32 +131,31 @@ Installation leaves nothing behind that production does not need:
 Development headers (`-dev` packages) are deliberately kept: they are
 what child images need to build things.
 
-## Building
-
-Native architecture only:
+## Building and releasing
 
 ```sh
-docker build -t git.eeqj.de/sneak/baseimage:latest .
+make release        # build, test, push both arches, tag, commit logs
+make -j2 release    # same, with the two arches in parallel
+make build          # build for this machine's arch only
+make test           # smoke-test this machine's build
 ```
 
-### Release build
+Each architecture is built natively on a daemon of that architecture: arm64
+on the local daemon, amd64 on `fsn1app1` via `DOCKER_HOST`. The daemon per
+arch is set by `DOCKER_HOST_amd64` and `DOCKER_HOST_arm64` in the
+`Makefile` and can be overridden on the command line. The release date
+defaults to today and can be overridden with `DATE=YYYY-MM-DD`.
 
-Each architecture is built natively on a host of that architecture (arm64
-locally, amd64 on `fsn1app1` via `DOCKER_HOST=ssh://root@fsn1app1`), pushed
-under a per-arch tag, and then joined into a multi-arch manifest:
+`make release` runs, per arch, `bin/build`, `bin/test`, and `bin/push`,
+then `bin/manifest` to join the per-arch tags into `latest` and the dated
+tag, then `bin/commit-logs` to commit `logs/YYYY-MM-DD/` and push the repo.
+`bin/test` checks that the toolchains resolve, yarn and pnpm work offline,
+nothing is left in `/tmp`, and a runit service is stopped cleanly by
+`docker stop` with exit code 0.
 
-```sh
-# on each host, for its own arch
-docker build --progress=plain -t baseimage:dev . 2>&1 | tee logs/YYYY-MM-DD/build-ARCH.log
-docker tag baseimage:dev git.eeqj.de/sneak/baseimage:ARCH
-docker push git.eeqj.de/sneak/baseimage:ARCH
-
-# once both per-arch tags are in the registry
-docker buildx imagetools create \
-    -t git.eeqj.de/sneak/baseimage:latest \
-    -t git.eeqj.de/sneak/baseimage:YYYY-MM-DD \
-    git.eeqj.de/sneak/baseimage:amd64 git.eeqj.de/sneak/baseimage:arm64
-```
+Registry login is done once on the local docker client with
+`docker login git.eeqj.de`; the client forwards the credentials to the
+remote daemon on push.
 
 Tags:
 
@@ -184,6 +183,9 @@ Interactive shells (login shells, or anything that sources
 
 ## Layout
 
+- `Makefile` — target wiring and configuration only; no logic.
+- `bin/` — one script per step: `build`, `test`, `push`, `manifest`,
+  `commit-logs`, `clean`, plus `lib.sh` (shared setup) and `native-arch`.
 - `Dockerfile` — base, environment, one `COPY`, one `ADD`, one `RUN`.
 - `build.sh` — everything the `RUN` does, in order: apt, Go, runsvinit,
   golangci-lint, Hugo, nvm/Node/corepack/wrangler, pyenv/Python, cleanup,