- Dockerfile: distroless base (glibc) for CGO binary - GoReleaser: Docker build + push to ghcr.io/lukaszraczylo/filepuff-mcp - Cosign signing for Docker manifests