fix: install ca-certificates with rpm --noscripts to avoid QEMU issues

The ca-certificates package scriptlets fail under ARM64 QEMU emulation
when using dnf --installroot because scriptlets cannot find /bin/sh
in the chroot environment.

Solution:
1. Install core packages (filesystem, bash, python, procps-ng) with dnf
   - These scriptlets work fine with --installroot
2. Download ca-certificates package separately
3. Install ca-certificates using rpm with --noscripts flag
   - Bypasses scriptlet execution entirely
   - Package files are installed correctly
   - Avoids QEMU emulation scriptlet failures

Tested locally: rpm --noscripts approach successfully installs
ca-certificates without errors.

Fixes multiplatform build failures in PR #1166

Signed-off-by: Manav Gupta <[email protected]>

Author: manavgup

Containerfile.lite

@@ -108,24 +108,25 @@ RUN python3 -OO -m compileall -q /app/.venv /app/mcpgateway /app/plugins \
 # ----------------------------------------------------------------------------
 # Build a minimal, fully-patched rootfs containing only the runtime Python
 # Include ca-certificates for HTTPS connections
+# Note: ca-certificates installed separately to avoid scriptlet issues with QEMU
 # ----------------------------------------------------------------------------
 # hadolint ignore=DL3041
 RUN set -euo pipefail \
     && mkdir -p "${ROOTFS_PATH:?}" \
     && dnf --installroot="${ROOTFS_PATH:?}" --releasever=10 upgrade -y \
-    && dnf --installroot="${ROOTFS_PATH:?}" --releasever=10 install -y \
+    && dnf --installroot="${ROOTFS_PATH:?}" \
+         --releasever=10 \
          --setopt=install_weak_deps=0 \
          --setopt=tsflags=nodocs \
          --setopt=skip_if_unavailable=1 \
+         install -y \
          filesystem \
          bash \
-    && dnf --installroot="${ROOTFS_PATH:?}" --releasever=10 install -y \
-         --setopt=install_weak_deps=0 \
-         --setopt=tsflags=nodocs,noscripts \
-         --setopt=skip_if_unavailable=1 \
          python${PYTHON_VERSION} \
-         ca-certificates \
          procps-ng \
+    && dnf download --installroot="${ROOTFS_PATH:?}" --releasever=10 ca-certificates \
+    && rpm --root="${ROOTFS_PATH:?}" --install --nodeps --noscripts ca-certificates-*.rpm \
+    && rm -f ca-certificates-*.rpm \
     && dnf clean all --installroot="${ROOTFS_PATH:?}"
 
 # ----------------------------------------------------------------------------