ci: the container gate and the version parse move into a compiled tool

tests/fixtures/README.md

@@ -35,3 +35,7 @@ Regenerate with:
 ```sh
 openssl ecparam -name prime256v1 -genkey -noout -out mismatched_key.pem
 ```
+
+`container-smoke.zon` is the smallest configuration that lets the daemon reach
+`serving`. `tools/container_check.zig` copies it into the smoke container, which
+is the only thing that reads it.

tests/fixtures/container-smoke.zon

@@ -0,0 +1,4 @@
+.{
+    .groups = .{ .{ .name = "default" } },
+    .upstreams = .{ .{ .url = "https://cloudflare-dns.com/dns-query" } },
+}