[Mearman]

Adds tool-images/strace, a tool-cache capability image holding one statically linked strace, to be declared with path: strace/<version>.

It builds the upstream 7.2 source tarball on Alpine with LDFLAGS=-static and no multilib personalities. The tarball is checked against a pinned SHA-256 and its detached signature against the maintainer's key, pinned by fingerprint, the same way the Terraform and AWS CLI images verify theirs. The version-bump note in the Dockerfile says both values are re-derived with the version.

A pod's processes may trace their own descendants at ptrace_scope 1, so the capability needs no Linux capability and no change to the pod's security context. Linking statically keeps it independent of the runner image's libraries.

Checked by building the Dockerfile in a runner pod on a Linux amd64 host, copying /toolcache out and running the binary as the runner user: strace -V reports 7.2, and strace -f -y -e trace=%file records a failed lookup. The arm64 build has not been run; publish-tool-images.yml builds both architectures when started.

Publishing it is a manual publish-tool-images.yml run, after which the GitHub Container Registry package needs making public.