Fixes #3
Add a community Dockerfile for tack and cover it in Buildkite so it does not drift unnoticed. The Docker build uses the Go version pinned by go.mod, installs CA certificates in a slim Debian runtime image, and keeps common local artifacts out of the Docker build context.
The new Buildkite step builds the image and runs tack -h, matching the
existing Nix package smoke test without requiring runtime configuration,
credentials, or external services.