backhaul-agent: public containerized DB-backup client

One docker run on a database's private network starts backing it up:
- backhaul-agent.py: stdlib-only sidecar — every-minute check-in, app-owned
  dump schedule, streams pg_dump/mysqldump/mongodump home chunked, self-updates.
- entrypoint.sh: bootstraps the newest script, installs the once-a-minute cron
  (sources persisted env), runs once immediately, hands off to cron; logs to a
  file surfaced via docker logs.
- Dockerfile: debian-slim + pg_dump 17 (PGDG — required for Postgres 17 servers)
  + mysql client. Mongo tools to follow.
- CI builds + pushes the public image and asserts the dump tools are present.

Dockerfile

@@ -0,0 +1,26 @@
+# backhaul-agent — the public, containerized DB-backup client. Runs as a sidecar on a
+# database's private Docker network: reaches the DB internally, pushes dumps home over HTTPS.
+# No inbound ports. The agent logic is pure stdlib Python; this image just adds the DB dump
+# tools and a once-a-minute cron.
+FROM debian:bookworm-slim
+
+# postgresql-client-17 from PGDG (Debian's default is 15, and pg_dump refuses a newer server
+# major — nc-db and most modern Postgres are 17). default-mysql-client covers MySQL/MariaDB.
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+        ca-certificates curl gnupg python3 cron default-mysql-client; \
+    install -d /usr/share/postgresql-common/pgdg; \
+    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+        -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc; \
+    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
+        > /etc/apt/sources.list.d/pgdg.list; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends postgresql-client-17; \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY backhaul-agent.py /app/backhaul-agent.py
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]