begin embedded pds with xrpc endpoints and well-known

Dockerfile.hold

@@ -1,5 +1,9 @@
 FROM golang:1.25.2-trixie AS builder
 
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
 WORKDIR /build
 
 COPY go.mod go.sum ./
@@ -7,8 +11,9 @@ RUN go mod download
 
 COPY . .
 
-RUN CGO_ENABLED=0 go build \
-    -ldflags="-s -w" \
+RUN CGO_ENABLED=1 go build \
+    -ldflags="-s -w -linkmode external -extldflags '-static'" \
+    -tags sqlite_omit_load_extension \
     -trimpath \
     -o atcr-hold ./cmd/hold
 
@@ -21,7 +26,7 @@ FROM scratch
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 # Copy timezone data for timestamp formatting
 COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
-# Copy optimized binary
+# Copy optimized binary (SQLite embedded)
 COPY --from=builder /build/atcr-hold /atcr-hold
 
 # Expose default port