Add Dockerfile and README

Prebuilt glibc image for pass-cli: a small debian:bookworm-slim base with
a pinned, checksum-verified pass-cli binary, published so Alpine/musl-based
CI jobs can pull and run it without hitting missing glibc symbols
(fcntl64, __res_init, etc, which gcompat/libc6-compat don't shim).

No ENTRYPOINT, just CMD ["pass-cli"] -- callers running their own script
against pass-cli mount it in and pass it as the command directly
(`docker run image sh /script.sh`), no --entrypoint override needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,32 @@
+# pass-cli, glibc-linked, for hosts/CI where only an Alpine (musl) base is
+# otherwise available. pass-cli's Linux binary needs real glibc symbols
+# (fcntl64, __res_init, ...) that Alpine's gcompat/libc6-compat don't shim,
+# so it can't run in e.g. the docker:cli image directly.
+#
+# No ENTRYPOINT -- just CMD ["pass-cli"]. `docker run this-image` runs bare
+# pass-cli; `docker run this-image <args>` replaces CMD entirely, so a
+# caller running their own script against pass-cli (login, fetch a note,
+# parse it, etc.) just does `docker run this-image sh /path/to/script.sh`
+# with no --entrypoint override needed. The cost: `docker run this-image
+# --version` doesn't work as shorthand -- write `docker run this-image
+# pass-cli --version` instead.
+
+FROM debian:bookworm-slim
+
+ARG PASS_CLI_VERSION=2.3.3
+ARG PASS_CLI_SHA256=b5b49a8b3fd0af8830c0c1979f28ea0c90ccece73f59023a8bca8245d4b68da9
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && curl -fsSL -o /usr/local/bin/pass-cli \
+         "https://proton.me/download/pass-cli/${PASS_CLI_VERSION}/pass-cli-linux-x86_64" \
+    && echo "${PASS_CLI_SHA256}  /usr/local/bin/pass-cli" | sha256sum -c - \
+    && chmod +x /usr/local/bin/pass-cli \
+    && apt-get purge -y curl \
+    && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/*
+
+# No kernel keyring in a container -- store the session on disk instead.
+ENV PROTON_PASS_KEY_PROVIDER=fs
+
+CMD ["pass-cli"]