packaging(bascule-gateway): production Dockerfile

Multi-stage rust:bookworm → debian:bookworm-slim build, modeled on
guildhouse/services/Dockerfile (F.2). Build context is the
substrate-project repo root because bascule-gateway's Cargo.toml has
cross-workspace path deps reaching:

  - ../../substrate/crates/governance-types (and substrate-rt
    transitively, which inherits edition from substrate's workspace
    root — substrate must be COPYed as a whole for the inheritance
    chain to load)
  - ../../guildhouse/services/{accord-core, accord-opa, qm-core,
    guildhouse-proto}
  - ../../guildhouse/sdk/{guildhouse-mq, guildhouse-tower} via
    transitive deps

Image output: git.guildhouse.dev/tking/bascule-gateway:v0.1.0.

Signed-off-by: Tyler J King <tking@guildhouse.dev>

bascule-gateway/Dockerfile

@@ -0,0 +1,45 @@
+# Bascule gateway — F.4 production image.
+#
+# BUILD CONTEXT: substrate-project repo root (two levels above bascule-workspace/).
+# Rationale: bascule-gateway's Cargo.toml has cross-workspace path
+# dependencies reaching:
+#   - ../../guildhouse/services/accord-core
+#   - ../../guildhouse/services/accord-opa
+#   - ../../guildhouse/services/qm-core
+#   - ../../guildhouse/services/guildhouse-proto
+#   - ../../substrate/crates/governance-types
+#   - (transitively) ../../guildhouse/sdk/guildhouse-mq, guildhouse-tower
+#   - bascule-workspace siblings (bascule-core, bascule-proto)
+#
+# Invocation:
+#   docker build -t git.guildhouse.dev/tking/bascule-gateway:v0.1.0 \
+#     -f bascule-workspace/bascule-gateway/Dockerfile \
+#     <substrate-project root>
+
+FROM rust:bookworm AS builder
+WORKDIR /app
+RUN apt-get update && apt-get install -y protobuf-compiler && rm -rf /var/lib/apt/lists/*
+
+# Cross-workspace path deps (change rarely). substrate is copied as a
+# whole because its crates inherit `edition.workspace = true` from the
+# substrate workspace root Cargo.toml — copying just substrate/crates
+# orphans the inheritance chain. Workspace members that live outside
+# substrate/crates/ (metakernel/, shell/loader, shellstream/) need to be
+# present for `cargo build` to load the workspace metadata, even though
+# bascule's actual dep tree only reaches into substrate/crates/.
+COPY substrate ./substrate
+COPY guildhouse/sdk ./guildhouse/sdk
+COPY guildhouse/services ./guildhouse/services
+
+# bascule-workspace itself (includes bascule-core, bascule-proto,
+# and all sibling crates the workspace Cargo.toml references).
+COPY bascule-workspace ./bascule-workspace
+
+WORKDIR /app/bascule-workspace
+RUN cargo build --release --bin bascule-gateway
+
+FROM debian:bookworm-slim AS runtime
+RUN apt-get update && apt-get install -y libssl3 ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /app/bascule-workspace/target/release/bascule-gateway /usr/local/bin/
+EXPOSE 50052
+CMD ["bascule-gateway"]