feat(ENG-12826): build standalone CLI binaries with PyInstaller + clean-room smoketest

.github/scripts/binaries-matrix.json

@@ -0,0 +1,74 @@
+{
+  "include": [
+    {
+      "name": "linux-x86_64-gnu",
+      "build_runner": "ubuntu-24.04",
+      "mode": "glibc",
+      "build_image": "almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb",
+      "test_runner": "ubuntu-24.04",
+      "test_kind": "docker",
+      "test_images": "debian:11-slim@sha256:ff4b13408ab702565720c6b23582ebda7bfdddfe9ce2b8c5b49e6d40430fdb05 almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb",
+      "archive": ".tar.gz"
+    },
+    {
+      "name": "linux-x86_64-musl",
+      "build_runner": "ubuntu-24.04",
+      "mode": "alpine",
+      "build_image": "python:3.12-alpine@sha256:dbb1970cc04ce7d381c65efe8309c0c03d463e5b35c88f14d721796ad24cfbfd",
+      "test_runner": "ubuntu-24.04",
+      "test_kind": "docker",
+      "test_images": "alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc",
+      "archive": ".tar.gz"
+    },
+    {
+      "name": "linux-aarch64-gnu",
+      "build_runner": "ubuntu-24.04-arm",
+      "mode": "glibc",
+      "build_image": "almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb",
+      "test_runner": "ubuntu-24.04-arm",
+      "test_kind": "docker",
+      "test_images": "debian:11-slim@sha256:ff4b13408ab702565720c6b23582ebda7bfdddfe9ce2b8c5b49e6d40430fdb05 almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb",
+      "archive": ".tar.gz"
+    },
+    {
+      "name": "linux-aarch64-musl",
+      "build_runner": "ubuntu-24.04-arm",
+      "mode": "alpine",
+      "build_image": "python:3.12-alpine@sha256:dbb1970cc04ce7d381c65efe8309c0c03d463e5b35c88f14d721796ad24cfbfd",
+      "test_runner": "ubuntu-24.04-arm",
+      "test_kind": "docker",
+      "test_images": "alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc",
+      "archive": ".tar.gz"
+    },
+    {
+      "name": "macos-arm64",
+      "build_runner": "macos-14",
+      "mode": "native",
+      "build_image": "",
+      "test_runner": "macos-14",
+      "test_kind": "macos",
+      "test_images": "",
+      "archive": ".tar.gz"
+    },
+    {
+      "name": "macos-x86_64",
+      "build_runner": "macos-15-intel",
+      "mode": "native",
+      "build_image": "",
+      "test_runner": "macos-15-intel",
+      "test_kind": "macos",
+      "test_images": "",
+      "archive": ".tar.gz"
+    },
+    {
+      "name": "windows-x86_64",
+      "build_runner": "windows-2025",
+      "mode": "native",
+      "build_image": "",
+      "test_runner": "windows-2025",
+      "test_kind": "windows",
+      "test_images": "",
+      "archive": ".zip"
+    }
+  ]
+}

.github/scripts/check_wheel.py

@@ -0,0 +1,17 @@
+# Copyright 2026 Cloudsmith Ltd
+"""Fail if the built wheel contains packaging or test files."""
+import glob
+import zipfile
+
+wheel = glob.glob("dist/*.whl")
+if len(wheel) != 1:
+    raise SystemExit(f"expected one wheel, found: {wheel}")
+with zipfile.ZipFile(wheel[0]) as archive:
+    names = archive.namelist()
+forbidden = [
+    name
+    for name in names
+    if name.startswith("packaging/") or "/tests/" in name or name.startswith("tests/")
+]
+if forbidden:
+    raise SystemExit(f"wheel contains non-runtime files: {forbidden}")