Merge 305a28c981 into 064eac2199

The sidecar uses a read-only filesystem which prevents Python from
creating bytecode at runtime. The previous approach pre-compiled
bytecode in a separate base image, but timestamps were corrupted
when files were copied between Docker stages, causing Python to
mark the bytecode as stale and recompile on every invocation.

This change builds Python dependencies as wheels in a pythonbuilder
stage using BuildKit cache mounts, then installs them in the final
python:3.13-slim-trixie stage using a bind mount. Wheels include
pre-compiled bytecode with correct timestamps. The bind mount keeps
wheels out of final layers, and the distroless complexity is
eliminated.

After wheel installation, we run compileall to ensure all Python
bytecode is freshly compiled with correct timestamps, preventing
any stale bytecode from remaining in the final image.

The separate barmanbase image, its workflow, and related Renovate
configuration are no longer needed and have been removed.

Closes #711
Closes #735

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>

containers/Dockerfile.sidecar

@@ -78,10 +78,11 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Install wheels using bind mount (wheels not included in final layers)
-# and ensure all Python bytecode is freshly compiled with correct timestamps
 RUN --mount=type=bind,from=pythonbuilder,source=/wheels,target=/wheels \
-    pip install --no-cache-dir /wheels/*.whl && \
+    pip install --no-cache-dir /wheels/*.whl
-    python -m compileall -q
+
+# Ensure all Python bytecode is freshly compiled with correct timestamps
+RUN python -m compileall -q /usr/local/lib/python3.13
 
 # Copy Go manager binary
 COPY --from=gobuilder /workspace/manager /manager