Align API lock metadata and add Factory Python 3.12 runtime recipe

Dockerfile.factory-runtime

@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1.7
+# Shared Linux amd64 Python 3.12 runtime for Factory's bootstrap, workers and
+# text peer. Factory supplies its coordinator, TLS configuration and callbacks.
+# This recipe does not include a model snapshot or launch any service.
+FROM ghcr.io/astral-sh/uv:0.11.21@sha256:6f1fa8fc4040ad7197d7e652057219871e5f6640abfe2b790f1419fdb2319e6b AS uv
+FROM python:3.12.13-slim-bookworm@sha256:6e13e65c55e33adf203d77ee371cf8bf5d81bd4902ef07565721f46bf44917af
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PATH=/workspace/.venv/bin:${PATH} \
+    UV_NO_CACHE=1 \
+    UV_LINK_MODE=copy
+
+COPY --from=uv /uv /usr/local/bin/uv
+WORKDIR /workspace
+COPY pyproject.toml uv.lock README.md ./
+COPY src ./src
+
+# cpufeature 0.2.1 has no cp312 wheel in this lock and must compile from its
+# locked sdist. --locked checks project metadata; --frozen would miss stale
+# API extras. Keep the lock's Linux Torch/CUDA dependency set for GPU workers;
+# this is not the CPU-wheel substitution used by Dockerfile.qualification.
+RUN apt-get update \
+    && apt-get install --no-install-recommends --yes build-essential ca-certificates libgomp1 \
+    && uv sync --locked --extra api --no-dev --no-editable --python /usr/local/bin/python \
+    && uv pip check --python /workspace/.venv/bin/python \
+    && python -c 'import cpufeature, fastapi, httpx, uvicorn' \
+    && apt-get purge --auto-remove --yes build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+# Build when separately authorized:
+# docker build --platform linux/amd64 -f Dockerfile.factory-runtime -t communityai-factory-runtime .
+# GPU workers still need a GPU host and its driver; Factory selects role args.
+CMD ["drift", "--help"]