feat(dependencies): add @redocly/cli and update CI workflows

- Added `@redocly/cli` version 1.34.5 to `package.json` and `pnpm-lock.yaml` for OpenAPI linting.
- Updated CI workflows to reflect changes in job names and processes, including adjustments to the `publish` job in the CD workflow.
- Enhanced documentation to clarify the new CI/CD processes and Docker build configurations.

deploy/docker/gobinary/Dockerfile

@@ -1,19 +1,23 @@
 # syntax=docker/dockerfile:1.7
 # Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
-# INSTALL_BIRDC=1 — birdc из stage birdc (собирается один раз, переиспользуется api/all).
+# Воркеры (runtime): distroless static. api/all (runtime-birdc): debian-slim + birdc.
 # CI: docker buildx bake -f deploy/docker/docker-bake.hcl
-FROM public.ecr.aws/docker/library/golang:1.24-bookworm AS deps
+ARG BASE_GOLANG=public.ecr.aws/docker/library/golang:1.24-alpine
+ARG BASE_DEBIAN=public.ecr.aws/docker/library/debian:bookworm-slim
+ARG BASE_DISTROLESS=gcr.io/distroless/static-debian12:nonroot
+
+FROM ${BASE_GOLANG} AS deps
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     go mod download
 
 FROM deps AS build-all
-COPY . .
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
-RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
     set -eux; \
     mkdir -p /out; \
@@ -29,12 +33,12 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
 
 # Один бинарь (локальная сборка); в CI — build-all + runtime.
 FROM deps AS build
-COPY . .
 ARG BIN=evobgp-api
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
-RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
     CGO_ENABLED=0 go build -trimpath \
       -ldflags="-s -w \
@@ -43,29 +47,33 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
         -X evobgp/internal/version.BuildTime=${BUILD_TIME}" \
       -o /out/evobgp "./cmd/${BIN}"
 
-FROM public.ecr.aws/docker/library/debian:bookworm-slim AS birdc
+FROM ${BASE_DEBIAN} AS birdc
 ARG BIRD_VERSION=2.14
 COPY deploy/docker/bird/bird-from-source.sh /tmp/bird-from-source.sh
-RUN chmod +x /tmp/bird-from-source.sh \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && chmod +x /tmp/bird-from-source.sh \
     && BIRD_VERSION="${BIRD_VERSION}" /tmp/bird-from-source.sh \
     && rm -f /tmp/bird-from-source.sh
 
-FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-FROM runtime-base AS runtime
+# scheduler / ingest / render / deploy / node — static Go, без shell.
+FROM ${BASE_DISTROLESS} AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
-COPY scripts/firewall /opt/evobgp/scripts/firewall
-ENV EVOBGP_FIREWALL_SCRIPTS=/opt/evobgp/scripts/firewall
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
 
-FROM runtime AS runtime-birdc
-# birdc: динамическая линковка readline + ncurses (debian bookworm).
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends libreadline8 libncurses6 \
+# api / all — birdc (readline + ncurses). Только клиент birdc, без демона bird.
+FROM ${BASE_DEBIAN} AS runtime-birdc
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates libreadline8 libncurses6 \
     && rm -rf /var/lib/apt/lists/*
-COPY --from=birdc /usr/local/sbin/bird /usr/local/sbin/birdc /usr/local/sbin/
+ARG BIN=evobgp-api
+COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY --from=birdc /usr/local/sbin/birdc /usr/local/sbin/birdc
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/evobgp"]