build(site): containerize local production validation

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.arbor-cache.json
+public
+temp

AGENTS.md

@@ -0,0 +1,5 @@
+# Repository guide
+
+- Use the checked-in `./arbor`; do not add Node.js, CSS frameworks, or another build step.
+- Prefer semantic HTML and existing Ivy/Lattice styles; check `STYLEREF.md` before adding custom CSS or JavaScript.
+- Do not edit generated site data or commit `public/`. Validate the production build with `docker build --platform linux/amd64 --file container/Dockerfile .`; it runs data sync and Arbor checks without modifying the checkout.

README.md

@@ -18,6 +18,17 @@ Opens a live-reloading dev server at `http://localhost:8080`. Changes to content
 
 ---
 
+## Production build
+
+Run the production build in a container so its generated data and output stay
+outside the checkout:
+
+```bash
+docker build --platform linux/amd64 --file container/Dockerfile .
+```
+
+---
+
 ## Content types
 
 ### Blog posts

container/Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.12-slim-bookworm AS build
+
+WORKDIR /site
+COPY . .
+
+RUN bash scripts/sync-data.sh \
+    && ./arbor check \
+    && ./arbor build
+
+FROM scratch
+
+COPY --from=build /site/public/ /

scripts/sync-data.sh

@@ -4,7 +4,8 @@
 
 set -euo pipefail
 
-cd "$(git rev-parse --show-toplevel)"
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
 
 python3 sync-tags.py
 bash scripts/update-latest-post.sh