feat: add toolchain harness for the 11 Arcline Go tools

Harness that clones the 11 Go tools (arcline-uptime, -check, -audit,
-dns, -vault, -email, -migrate, -billing, -portal, -website, -status)
from git.arcline.it, builds release binaries, and packages each into a
.deb that configure-system installs into the image. Tools that cannot
be fetched or built are skipped without breaking the OS build.

toolchain/build-tools.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — toolchain .deb builder
+#
+#   toolchain/build-tools.sh
+#   ARCLINE_TOOLS_DIR=/path/to/checkouts toolchain/build-tools.sh
+#
+# For each tool in tools.list:
+#   1. obtain source (local checkout if ARCLINE_TOOLS_DIR set, else git clone)
+#   2. build a release binary (tries common Go layouts)
+#   3. package a .deb into build/debs/
+#
+# Skips (with a warning) anything it cannot build — the OS image must never
+# break because a tool repo is unreachable. Requires Go and dpkg-deb.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/../scripts/common.sh"
+
+VERSION="${VERSION:-0.1.0}"
+ARCH="${ARCH:-amd64}"
+SRC_DIR="$ROOT/build/toolchain-src"
+LOCAL_TOOLS="${ARCLINE_TOOLS_DIR:-}"
+TOOLS_LIST="$ROOT/toolchain/tools.list"
+
+command -v go >/dev/null || die "go not found (toolchain build needs Go ≥ 1.21)"
+command -v dpkg-deb >/dev/null || die "dpkg-deb not found"
+
+mkdir -p "$SRC_DIR" "$DEB_DIR"
+log "toolchain build → $DEB_DIR (version $VERSION, arch $ARCH)"
+
+built=0; skipped=0
+
+while IFS='|' read -r name repo desc; do
+  [[ -n "$name" ]] || continue
+  [[ "$name" != \#* ]] || continue
+
+  # ── obtain source ─────────────────────────────────────────────────────────
+  if [[ -n "$LOCAL_TOOLS" && -d "$LOCAL_TOOLS/$name" ]]; then
+    SRC="$LOCAL_TOOLS/$name"
+    log "using local checkout: $name"
+  else
+    SRC="$SRC_DIR/$name"
+    if [[ ! -d "$SRC/.git" ]]; then
+      log "cloning: $name"
+      git clone --depth 1 --quiet "$repo" "$SRC" 2>/dev/null \
+        || { warn "could not fetch $name (repo unreachable), skipping"; skipped=$((skipped+1)); continue; }
+    fi
+  fi
+
+  # ── build ─────────────────────────────────────────────────────────────────
+  BUILD=""
+  for target in "./cmd/$name" "./cmd" "./" ; do
+    if [[ -f "$SRC/$target/go.mod" || -f "$SRC/$target/main.go" ]]; then
+      BUILD="$target"; break
+    fi
+  done
+  if [[ -z "$BUILD" ]]; then
+    warn "$name: no go.mod/main.go found in a known layout, skipping"
+    skipped=$((skipped+1)); continue
+  fi
+
+  log "building: $name (go build $BUILD)"
+  (
+    cd "$SRC"
+    go build -trimpath -mod=mod -ldflags "-s -w -X main.version=$VERSION" -o "$ROOT/build/$name" "$BUILD"
+  ) || { warn "$name: go build failed, skipping"; skipped=$((skipped+1)); continue; }
+
+  # ── package .deb ──────────────────────────────────────────────────────────
+  PKG="$ROOT/build/pkg-$name"
+  rm -rf "$PKG"
+  mkdir -p "$PKG/DEBIAN" "$PKG/usr/bin"
+  install -m0755 "$ROOT/build/$name" "$PKG/usr/bin/$name"
+  cp "$ROOT/toolchain/debian/control.tmpl" "$PKG/DEBIAN/control"
+  sed -i \
+    -e "s/__NAME__/$name/g" \
+    -e "s/__VERSION__/$VERSION/g" \
+    -e "s/__ARCH__/$ARCH/g" \
+    -e "s/__DESC__/${desc}/g" \
+    "$PKG/DEBIAN/control"
+
+  dpkg-deb --build --root-owner-group "$PKG" "$DEB_DIR/${name}_${VERSION}_${ARCH}.deb" >/dev/null
+  log "packaged: ${name}_${VERSION}_${ARCH}.deb"
+  built=$((built+1))
+done < "$TOOLS_LIST"
+
+rm -rf "$ROOT/build/pkg-"* "$ROOT/build/$name" 2>/dev/null || true
+
+log "toolchain complete: $built built, $skipped skipped"
+[[ $built -gt 0 ]] || warn "nothing was built — check repo access / ARCLINE_TOOLS_DIR"