build: add Ubuntu 22.04 portable binary pipeline

Dockerfile.build

@@ -0,0 +1,32 @@
+# Build image for Cellar binaries, targeting glibc 2.35 (Ubuntu 22.04).
+# This keeps the binaries compatible with older systems than the host Fedora
+# build, while still providing GTK4/libadwaita packages.
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# ── System deps ──────────────────────────────────────────────────────────────
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-dev python3-pip python3-venv \
+    # GTK4 / Adwaita
+    libgtk-4-dev libadwaita-1-dev python3-gi python3-gi-cairo \
+    gir1.2-gtk-4.0 gir1.2-adw-1 libglib2.0-dev \
+    # Misc build deps
+    build-essential git libffi-dev libssl-dev \
+    # UPX
+    upx-ucl \
+    # binutils for strip
+    binutils \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── Python environment ───────────────────────────────────────────────────────
+RUN python3 -m venv --system-site-packages /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+RUN python -m pip install --no-cache-dir --upgrade pip setuptools wheel \
+    && python -m pip install --no-cache-dir pyinstaller requests
+
+# ── Build ─────────────────────────────────────────────────────────────────────
+WORKDIR /src
+COPY . .
+
+CMD ["/bin/bash", "/src/scripts/build-binaries.sh"]

scripts/build-binaries.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export HOME="${HOME:-/tmp}"
+export PYINSTALLER_CONFIG_DIR="${PYINSTALLER_CONFIG_DIR:-/tmp/pyinstaller-cache}"
+
+cd /src
+
+echo "==> Python"
+python --version
+echo
+
+echo "==> Cleaning previous artifacts"
+rm -rf build dist
+mkdir -p dist
+echo
+
+echo "==> Building cellar-cli"
+python -m PyInstaller cellar-cli.spec --clean --noconfirm
+echo
+
+echo "==> Building cellar GTK"
+python -m PyInstaller cellar.spec --clean --noconfirm
+echo
+
+echo "==> Built files"
+ls -lh dist
+echo
+
+show_glibc_requirement() {
+    local binary="$1"
+    echo "-- $(basename "$binary")"
+    objdump -p "$binary" 2>/dev/null \
+        | grep -oE 'GLIBC_[0-9]+\.[0-9]+' \
+        | sort -Vu \
+        | tail -1
+}
+
+echo "==> GLIBC requirements"
+show_glibc_requirement dist/cellar-cli
+show_glibc_requirement dist/cellar
+echo
+
+echo "==> Done"