Distribute canton-barebones as a dpm component

[nicosampler]

User story / Problem statement

As a Canton developer using dpm (Digital Asset's package manager and the entry point of the Canton Network SDK), I want to install and run canton-barebones as a dpm component, so that I can manage the local Splice stack with the same tool as the rest of my toolchain — without installing Node.

Expected outcome

A developer in a project with a daml.yaml can run dpm add component oci://ghcr.io/bootnodedev/canton-barebones:latest (or declare it under components: and run dpm install package) and then use every CLI command as dpm canton-barebones <cmd> / dpm cbn <cmd>. The npm channel keeps working unchanged; both channels ship the same source and version.

Acceptance criteria

• The CLI compiles to a self-contained binary (no Node on the host) for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 and windows/amd64
• Each release publishes the component to ghcr.io/bootnodedev/canton-barebones with a strict-semver tag plus latest
• Pull requests validate the component layout and manifest (dpm publish component --dry-run) and smoke-test a compiled binary
• The npm channel is unchanged (same code path, tests green)
• README documents both dpm installation flows; a local end-to-end testing guide exists

Alternatives considered

• Rewriting the tool in Go as a built-in dpm subcommand — a true "move" into digital-asset/dpm, but it duplicates the implementation, hands over the release cycle, and dpm's designed extension path is OCI components.
• Shipping the component as a Node-wrapper script — smaller artifact but adds a Node >= 22 host requirement and breaks on Windows (dpm execs the command path directly, no shell).
• Publishing to Digital Asset's registry for short-name installs — no documented third-party process today; kept as a follow-up conversation.

Technical notes

Binaries are cross-compiled with bun build --compile from a single Linux CI job. The bundled templates/ are embedded at compile time and materialized into the project's .generated/ at runtime (docker compose needs a real file path). dpm requires a LICENSE at the component root — the repo previously had none (Apache-2.0 added). dpm is pinned by version + sha256 in CI via a shared composite action.