CI: surface risky Dockerfile content to reviewers, add Copilot review, fix S3 upload

[ypriverol]

Why

Container PRs (e.g. #621) can add arbitrary RUN content — the classic case is a
remote script piped into a shell (curl … | install.julialang.org | sh). A reviewer
skimming 20 lines can miss it. This adds defense-in-depth detection so nothing
"strange" merges unreviewed, plus a bioconda-style local test path, and fixes the
Singularity → S3 upload that was silently failing.

What

1. Deterministic Dockerfile risk scan (validate.py) — zero new deps.
scan_dockerfile_risks() lifts the lines a human must consciously approve into the PR
comment as an advisory 🔍 Reviewer checklist:

• curl … | sh / wget … | bash, ADD <url>, insecure http://, paste/URL-shortener/
  bare-IP hosts, chmod 777, --insecure/--no-check-certificate, non-biocontainers/*
  base image.
• Blocking: high-confidence embedded credentials (AWS/GitHub/Slack tokens, private keys).
• Backslash line-continuations are folded (a split curl \↵| sh can't evade); download
  rules are scoped to RUN/ADD/COPY so an http:// homepage in a LABEL is not a
  false positive. 12 new unit tests (30 total, all green).

2. Reviewer aids (pr-report.yml) — renders the checklist and a bioconda-style
"🧪 Build & test this container locally" block, pointing at the existing test-cmds.txt
convention. Untrusted report fields stay sanitized (same path as errors/warnings).

3. Copilot review layer — .github/copilot-instructions.md +
.github/instructions/dockerfile.instructions.md (applyTo: **/Dockerfile) so automatic
Copilot code review hunts the same risks on every container PR. (Requires enabling
automatic Copilot review + a Copilot subscription — repo owner action.)

4. S3 upload fix (publish.yml) — the Ceph/RGW store rejects aws-cli v2.23+ default
CRC32 checksums on multipart uploads (InvalidRequest on CreateMultipartUpload), so
every .sif over ~8 MB failed to upload. Set AWS_REQUEST/RESPONSE_CHECKSUM_CALCULATION= when_required. Confirmed the endpoint supports multipart via boto3; end-to-end re-test
after merge.

On #621

The scanner flags line 19 (curl … | sh) in the reviewer checklist; Copilot would comment
on it independently. Nothing blocks — it spotlights, so the human signs off explicitly.

[github-actions]

❌ BioContainers CI failed for container.

Errors (must fix):

• Cannot modify GitHub CI files (.github/copilot-instructions.md).
• Cannot modify GitHub CI files (.github/instructions/dockerfile.instructions.md).
• Cannot modify GitHub CI files (.github/scripts/tests/test_validate.py).
• Cannot modify GitHub CI files (.github/scripts/validate.py).
• Cannot modify GitHub CI files (.github/workflows/pr-report.yml).
• Cannot modify GitHub CI files (.github/workflows/publish.yml).