Localizes external-secrets off ghcr.io: clones the forge mirror at v2.2.0
and builds the single all_providers static Go binary, faithful to upstream's
`make build`. ENTRYPOINT is the binary so the controller/webhook/cert-controller
Deployments can select their role via args.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
