ci: the container gate and the version parse move into a compiled tool

build.zig

@@ -248,6 +248,27 @@ pub fn build(b: *std.Build) void {
     });
     test_step.dependOn(&b.addRunArtifact(release_tests).step);
 
+    // The container acceptance gate. Installed rather than run from the build
+    // graph for the same reason as the release tool: it needs a live docker
+    // daemon and the workflow's environment, neither of which a Run step in this
+    // graph can supply.
+    const container_check_tool = hostTool(b, "container_check");
+    b.step("container-check-tool", "Install the container gate tool into zig-out/bin")
+        .dependOn(&b.addInstallArtifact(container_check_tool, .{}).step);
+
+    // Its pure decisions — object naming, the ownership label, the inspect-JSON
+    // topology read, the probe deadline, the build.zig.zon version parse — are
+    // what the shell it replaced could never be tested on.
+    const container_check_tests = b.addTest(.{
+        .name = "container-check-tool",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("tools/container_check.zig"),
+            .target = b.graph.host,
+            .optimize = optimize,
+        }),
+    });
+    test_step.dependOn(&b.addRunArtifact(container_check_tests).step);
+
     addDist(b, options, web_assets, .{
         .version = version_option,
         .version_string = version_string,