Build Tempo container from source (2.10.3) (#323)

## Summary
- Add `containers/tempo/Dockerfile` — two-stage Go build from forge mirror, modeled on loki
- Switch kustomization from upstream `grafana/tempo` to `registry.ops.eblu.me/blumeops/tempo`
- Bump Tempo 2.10.1 → 2.10.3

## Test plan
- [ ] Kick off container build via `mise run container-build-and-release tempo`
- [ ] Update kustomization `newTag` with built image tag
- [ ] Deploy from branch: `argocd app set tempo --revision local-tempo-container && argocd app sync tempo`
- [ ] Verify Tempo health: `curl tempo.ops.eblu.me/ready`
- [ ] Verify traces flowing in Grafana Tempo datasource

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #323

argocd/manifests/tempo/kustomization.yaml

@@ -11,7 +11,8 @@ resources:
 
 images:
   - name: grafana/tempo
-    newTag: "2.10.1"
+    newName: registry.ops.eblu.me/blumeops/tempo
+    newTag: "v2.10.3-49ce545"
 
 configMapGenerator:
   - name: tempo-config

containers/tempo/Dockerfile

@@ -0,0 +1,40 @@
+# Grafana Tempo distributed tracing backend
+# Two-stage build: Go binary, Alpine runtime
+
+ARG CONTAINER_APP_VERSION=2.10.3
+ARG TEMPO_VERSION=v${CONTAINER_APP_VERSION}
+
+FROM golang:alpine3.22 AS build
+
+ARG TEMPO_VERSION
+RUN apk add --no-cache build-base git
+
+RUN git clone --depth 1 --branch ${TEMPO_VERSION} \
+    https://forge.ops.eblu.me/mirrors/tempo.git /go/src/app
+
+WORKDIR /go/src/app
+ENV CGO_ENABLED=0
+
+RUN go build -mod vendor \
+    -ldflags="-w -s \
+      -X main.Version=${TEMPO_VERSION} \
+      -X main.Branch=HEAD \
+      -X main.Revision=blumeops-build" \
+    -o /bin/tempo ./cmd/tempo
+
+FROM alpine:3.22
+
+ARG CONTAINER_APP_VERSION
+LABEL org.opencontainers.image.title="Tempo"
+LABEL org.opencontainers.image.description="Grafana Tempo distributed tracing backend"
+LABEL org.opencontainers.image.version="${CONTAINER_APP_VERSION}"
+LABEL org.opencontainers.image.source="https://forge.eblu.me/eblume/blumeops"
+LABEL org.opencontainers.image.vendor="blumeops"
+
+RUN apk add --no-cache ca-certificates tzdata
+RUN mkdir -p /var/tempo && chown 10001:10001 /var/tempo
+
+USER 10001
+COPY --from=build /bin/tempo /usr/bin/tempo
+EXPOSE 3200 4317 4318 9095
+ENTRYPOINT ["/usr/bin/tempo"]

docs/changelog.d/local-tempo-container.infra.md

@@ -0,0 +1 @@
+Build Tempo container from source via forge mirror; bump 2.10.1 → 2.10.3

service-versions.yaml

@@ -65,9 +65,10 @@ services:
 
   - name: tempo
     type: argocd
-    last-reviewed: 2026-03-05
-    current-version: "2.10.1"
+    last-reviewed: 2026-04-02
+    current-version: "2.10.3"
     upstream-source: https://github.com/grafana/tempo/releases
+    notes: Home-built container from forge mirror
 
   - name: alloy-tracing-ringtail
     type: argocd