fix(docker): force pytantan to build without any SIMD backends

[nextgenusfs]

Problem

The Docker image keeps shipping a pytantan build that raises Illegal instruction (SIGILL) at import time on x86_64 hosts without AVX2 — most notably Rosetta 2 on Apple Silicon.

PR #64 attempted to fix this by setting CMAKE_ARGS="-DHAVE_AVX2=OFF ..." as a shell env-var when invoking pip install. In practice this is not reliable: scikit-build-core (pytantan's build backend) parses/filters the args itself and the HAVE_AVX2/HAVE_SSE4/HAVE_NEON flags do not always propagate to the inner CMake call. The published image at sha256:fe43baf2... still SIGILLs at runtime.

Upstream's v0.1.4 added runtime dispatch via PyCapsule, but it does not help us because top-level imports of platform modules (pytantan/platform/avx2.*.so) still happen unconditionally, triggering AVX2 before the dispatcher gets a chance to pick the generic path on a non-AVX2 host.

Fix

This PR hardens the rebuild step:

1. Use the scikit-build-core supported channel. Pass HAVE_AVX2 / HAVE_SSE4 / HAVE_NEON = OFF (and empty *_C_FLAGS) through pip install --config-settings=cmake.define.* instead of the CMAKE_ARGS env var. This goes directly into scikit-build-core's parser and short-circuits pytantan's FindAVX2.cmake / FindSSE4.cmake / FindNEON.cmake via their if((DEFINED HAVE_*)) guard.
2. Disable pip cache + add verbose output (--no-cache-dir -v) so a stale wheel can never be reused and the build log is useful when something does go wrong.
3. Fail the Docker build loudly if SIMD code still ends up in the image. A new verification RUN step:
   • Errors out if any avx2.*.so / sse4.*.so / neon.*.so is present in pytantan/platform/.
   • Disassembles every *.so under the pytantan install dir with objdump -d -M intel and errors out if any of ymm[0-9]+, zmm[0-9]+, vpbroadcast, vextracti128, vinserti128 is found.
   • Runs a Python smoke import (from pytantan import Alphabet, RepeatFinder, default_scoring_matrix) to exercise the lib + platform dispatch path on the build host.

If any of these guards trip, the Docker build fails and we don't publish a broken image.

Refs

• Upstream issue: x86_64 wheels SIGILL on CPUs without AVX2 (e.g. Apple Silicon via Rosetta 2, pre-Haswell Intel) althonos/pytantan#2
• Previous attempt: Fix pytantan build error by disabling SIMD instructions #64

---

Pull Request opened by Augment Code with guidance from the PR author

[nextgenusfs]

Superseded by #66. The Dockerfile change merged in this PR set CMAKE_ARGS="-DHAVE_AVX2=OFF ..." as a shell env-var, which scikit-build-core silently dropped on the way to cmake — the published image still shipped pytantan/platform/avx2.*.so and SIGILLed under Rosetta 2. #66 switches to pip --config-settings=cmake.define.HAVE_AVX2=OFF (which actually reaches cmake) and adds a hard objdump/file-presence guard so a regression cannot publish another broken image.