Add ShapeMapper2 public container candidate

[edr-choi]

What changed

• add a smaller Linux/amd64 ShapeMapper2 v2.3 candidate built from the unchanged, checksum-pinned upstream source tag
• retain the official-release wrapper and its compliance records as a separate private reference recipe
• install source-traceable Debian runtime packages instead of redistributing the bundled Miniconda environment
• add smoke, complete upstream-suite, and digest-pinned Singularity/Apptainer validation scripts
• add redistribution notices, inventories, checksums, and a working public-release checklist
• add a self-contained GitHub Actions workflow that builds and tests the candidate without third-party Actions, records the Debian package inventory, and can manually push a private development image

Why

The official ShapeMapper release archive is approximately 1 GB and bundles a large historical Miniconda environment and prebuilt third-party tools. The source-based candidate is approximately 485 MiB in the provisional local build and has a simpler, source-traceable redistribution path. ShapeMapper itself remains unmodified and is fetched directly from the upstream v2.3 tag; no fork is introduced.

Validation

• ShapeMapper v2.3 source compiled successfully in two independent local builds
• the second low-memory build installed all Debian runtime dependencies before host disk exhaustion interrupted final layer assembly
• the private reference image passed the upstream example and all 208 built-in tests
• shell scripts pass bash -n
• JSON metadata and the reference SPDX document parse successfully
• the workflow YAML parses successfully

The pull-request workflow performs the missing final candidate build, upstream example, complete built-in test suite, runtime-command checks, package inventory, and image-size report. A fresh retained SBOM remains part of the later public-release gate.

Publication safety

Pull-request runs cannot publish an image and do not receive the GHCR secret. After this workflow is merged, a separately selected manual option can push a uniquely tagged private development image using EDR_CHOI_GHCR_TOKEN; the workflow verifies private visibility before and after the push and reports the immutable digest. Creating a release tag or changing GHCR visibility to public remains blocked on successful validation, completion of the candidate redistribution checklist, and explicit project-owner approval.