update ci

.build/prod/build.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#
+# Runs INSIDE the .build/prod container. Builds the Linux single-file binary and
+# drops it into .build/prod/out/ (mounted back to the host for the release step).
+#
+set -euo pipefail
+cd /source
+
+# The repo is bind-mounted from the host (owned by a different uid), so git
+# refuses to operate on it until we mark it safe:
+git config --global --add safe.directory '*'
+
+OUT_DIR="/source/.build/prod/out"
+mkdir -p "$OUT_DIR"
+
+# Reuse the platform-agnostic build (apply patches → build UI → embed → bun compile):
+OUT_NAME=httptoolkit bash scripts/build.sh
+
+# Smoke-test the Linux binary before we consider it releasable:
+bash scripts/smoke.sh dist/httptoolkit
+
+cp -v dist/httptoolkit "$OUT_DIR/httptoolkit-linux-x64"
+echo "==> Artifacts:"
+ls -lh "$OUT_DIR"