milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix

deploy/docker/Dockerfile

@@ -9,7 +9,10 @@
 #
 # The builder stage stages the CA bundle (upstream DoH/DoT verification rescans
 # the system store; a scratch image without one breaks every TLS upstream) and
-# maps the buildx TARGETARCH onto the zig cross-target directory.
+# maps the buildx TARGETARCH onto the zig cross-target directory. The legacy
+# builder leaves TARGETARCH empty, so the arch falls back to the build host's
+# `uname -m`: a plain `docker build` must never package a foreign binary that
+# only fails at `docker run` with exec-format.
 
 FROM alpine:3.22 AS builder
 RUN apk add --no-cache ca-certificates
@@ -17,7 +20,13 @@ ARG TARGETARCH
 COPY zig-out/cross /cross
 RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/etc/nxdns /rootfs/var/lib/nxdns \
     && cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ \
-    && case "${TARGETARCH:-amd64}" in \
+    && arch="${TARGETARCH:-}" \
+    && if [ -z "$arch" ]; then case "$(uname -m)" in \
+         x86_64) arch=amd64 ;; \
+         aarch64) arch=arm64 ;; \
+         *) echo "unsupported build host $(uname -m); use buildx" >&2; exit 1 ;; \
+       esac; fi \
+    && case "$arch" in \
          amd64) cp /cross/x86_64-linux-musl/nxdns /rootfs/nxdns ;; \
          arm64) cp /cross/aarch64-linux-musl/nxdns /rootfs/nxdns ;; \
          *) echo "unsupported TARGETARCH '${TARGETARCH}'" >&2; exit 1 ;; \