Scaffold gitea-review-bot: thin matrix-nio PR-review bot (auto-map, threaded review, subagent panel, merge/reject/deploy)

Dockerfile

@@ -0,0 +1,21 @@
+# gitea-review-bot — Spark container. Generic image; secrets/config via read-only mounts at runtime.
+# Host networking (docker-compose) so it reaches Synapse (TLS), Gitea (LAN), and the Mac (SSH).
+FROM python:3.12-slim
+
+# openssh-client: the bot shells out to `ssh mac-bridge ...` to run the review + deploy on the Mac.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends openssh-client \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY src/ ./src/
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
+# .env and config.toml arrive via read-only mounts at runtime (never baked).
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+CMD ["python", "-u", "src/bot.py"]