Small Images: The Shell-less Runtime Base

The multi-stage Dockerfile at /root/case/Dockerfile builds a static binary in a full toolchain stage, but its runtime stage is bloated and attackable: it starts FROM a full ubuntu base and even re-runs a package install in the runtime layer. Harden the final stage so it ships essentially just the binary: switch its base to a minimal, shell-less runtime image (a distroless base — no shell, no package manager), and remove the package install from the runtime stage. Keep the build stage and the COPY --from that pulls the binary across. Grading reads the Dockerfile.