Initial minimal Flutter SDK image for web/WASM CI builds

- Dockerfile based on debian:bookworm-slim with web-only Flutter SDK
- Release pipeline with Docker Scout CVE scan, SBOM, and provenance
- Scout PR pipeline with check-image gate
- Daily update-check pipeline that auto-creates releases for new
  Flutter stable versions via Gitea API

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,51 @@
+FROM debian:bookworm-slim
+
+ARG FLUTTER_VERSION=3.38.9
+
+LABEL org.opencontainers.image.title="gpb-flutter-sdk-web"
+LABEL org.opencontainers.image.description="Minimal Flutter SDK for Web/WASM CI builds"
+LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
+
+# Install minimal dependencies for Flutter web builds
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    git \
+    unzip \
+    xz-utils \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV FLUTTER_HOME=/opt/flutter
+ENV PATH="${FLUTTER_HOME}/bin:${FLUTTER_HOME}/bin/cache/dart-sdk/bin:${PATH}"
+
+# Download Flutter SDK from official archive
+RUN curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz" \
+      -o /tmp/flutter.tar.xz && \
+    tar xf /tmp/flutter.tar.xz -C /opt && \
+    rm /tmp/flutter.tar.xz
+
+# Mark git directory as safe (tarball is owned by different uid)
+RUN git config --global --add safe.directory "${FLUTTER_HOME}"
+
+# Configure for web-only (disable everything else)
+RUN flutter config --enable-web \
+    --no-enable-android \
+    --no-enable-ios \
+    --no-enable-linux-desktop \
+    --no-enable-macos-desktop \
+    --no-enable-windows-desktop
+
+# Precache only web artifacts
+RUN flutter precache --web \
+    --no-android \
+    --no-ios \
+    --no-linux \
+    --no-macos \
+    --no-windows \
+    --no-fuchsia \
+    --no-universal
+
+# Verify installation
+RUN flutter doctor -v
+
+WORKDIR /app