fix: retain Sharp shared libraries in the runtime image

Copy the complete source-built Sharp package and the shared-library closure resolved in the working verification stage into the final image. Keep the change after application verification so existing compilation layers remain cacheable.

No manual checks or verification run, as requested.

Dockerfile

@@ -52,6 +52,18 @@ RUN --mount=type=cache,id=portfolio-next-node22,target=/app/.next/cache,sharing=
   npm run build
 RUN npm test
 
+# Carry the exact shared-library dependency closure from the working build stage.
+# Development packages can provide libraries that are absent from image-runtime.
+FROM verification AS native-runtime-libraries
+RUN mkdir -p /runtime-libs \
+    && (ldd /app/node_modules/sharp/src/build/Release/*.node /opt/vips/lib/libvips*.so* 2>/dev/null || true) \
+      | awk '/=> \// { print $3 } /^[[:space:]]*\// { print $1 }' \
+      | sort -u \
+      | while IFS= read -r library; do \
+          mkdir -p "/runtime-libs$(dirname "$library")"; \
+          cp -L "$library" "/runtime-libs$library"; \
+        done
+
 FROM image-runtime AS runtime
 
 WORKDIR /app
@@ -69,8 +81,9 @@ COPY --from=verification --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=verification --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=verification --chown=nextjs:nodejs /app/public ./public
 COPY --from=image-build /opt/vips/lib /opt/vips/lib
-# Explicitly retain the custom binding even if Next's file tracer misses it.
-COPY --from=dependencies --chown=nextjs:nodejs /app/node_modules/sharp/src/build/Release/*.node ./node_modules/sharp/src/build/Release/
+# Preserve the package and its native dependency closure beyond Next's tracing.
+COPY --from=dependencies --chown=nextjs:nodejs /app/node_modules/sharp/ ./node_modules/sharp/
+COPY --from=native-runtime-libraries /runtime-libs/ /
 COPY scripts/check-image-runtime.mjs ./scripts/check-image-runtime.mjs
 RUN node scripts/check-image-runtime.mjs --require-source
 RUN mkdir -p .next/cache /data && chown -R nextjs:nodejs .next/cache /data