docker: image build for cmd/rlp-{export,import} (closes #69 / #122 sidecar)

Dockerfiles for the two RLP utilities + GH workflow calling the
shared hanzoai/.github docker-build@main workflow. amd64-only,
lux-build-linux-amd64 runner pool per the cross-org isolation rule.

Consumed by the lux-operator ExportSchedules CronJob (#69) and the
TenantImports Job (#122). Both default to the in-cluster MinIO
endpoint at http://s3.lux-system.svc.cluster.local:9000.

Pre-existing modifications in builder/, configs/configs.go,
pkg/genesis/{config,networks,types,cert_policy}.go intentionally
left untouched per CTO commit-by-name discipline.

.github/workflows/docker-rlp.yml

@@ -0,0 +1,58 @@
+name: Docker rlp-import/rlp-export
+
+# Builds + publishes the two CronJob/Job images that the lux operator
+# wires into LuxNetwork.spec.{tenantImports,exportSchedules}. Driven
+# by the shared workflow at hanzoai/.github so all image tagging,
+# registry login, and BuildKit caching stays one-way across orgs.
+#
+# Trigger: any push to main (publishes :sha-<sha7>) or a v* tag
+# (publishes the semver tag). PRs build but do not publish.
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+    paths:
+      - 'cmd/rlp-export/**'
+      - 'cmd/rlp-import/**'
+      - 'Dockerfile.rlp-export'
+      - 'Dockerfile.rlp-import'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/docker-rlp.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'cmd/rlp-export/**'
+      - 'cmd/rlp-import/**'
+      - 'Dockerfile.rlp-export'
+      - 'Dockerfile.rlp-import'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  rlp-export:
+    name: rlp-export
+    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
+    with:
+      image-name: luxfi/rlp-export
+      dockerfile: Dockerfile.rlp-export
+      platforms: linux/amd64
+      runner-amd64: lux-build-linux-amd64
+      build-arm64:
+        if: false
+    secrets: inherit
+
+  rlp-import:
+    name: rlp-import
+    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
+    with:
+      image-name: luxfi/rlp-import
+      dockerfile: Dockerfile.rlp-import
+      platforms: linux/amd64
+      runner-amd64: lux-build-linux-amd64
+      build-arm64:
+        if: false
+    secrets: inherit

Dockerfile.rlp-export

@@ -0,0 +1,33 @@
+# Dockerfile for the rlp-export CronJob image. Symmetric with the
+# rlp-import image — both share the same minimal runtime (BusyBox
+# coreutils + the static Go binary).
+#
+# Build:
+#   docker build -f Dockerfile.rlp-export -t ghcr.io/luxfi/rlp-export:vX.Y.Z .
+#
+# Run (manual):
+#   docker run --rm -v $PWD/data:/data ghcr.io/luxfi/rlp-export:latest \
+#     --chain=C --output-file=/data/c-chain.rlp \
+#     --luxd-rpc=http://luxd:9630
+#
+# Reusable across the operator's CronJob template — the entrypoint is
+# the static binary; the CronJob template wraps it in a /bin/sh -c
+# script that injects a per-run timestamp.
+FROM golang:1.26-alpine AS builder
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH}
+RUN go build -trimpath -ldflags="-s -w" \
+    -o /out/rlp-export \
+    ./cmd/rlp-export
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates tzdata
+COPY --from=builder /out/rlp-export /usr/local/bin/rlp-export
+ENTRYPOINT ["/usr/local/bin/rlp-export"]

Dockerfile.rlp-import

@@ -0,0 +1,23 @@
+# Dockerfile for the rlp-import CronJob/Job image. Symmetric with the
+# rlp-export image — both share the same minimal runtime.
+#
+# Build:
+#   docker build -f Dockerfile.rlp-import -t ghcr.io/luxfi/rlp-import:vX.Y.Z .
+FROM golang:1.26-alpine AS builder
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH}
+RUN go build -trimpath -ldflags="-s -w" \
+    -o /out/rlp-import \
+    ./cmd/rlp-import
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates tzdata
+COPY --from=builder /out/rlp-import /usr/local/bin/rlp-import
+ENTRYPOINT ["/usr/local/bin/rlp-import"]