fix(docker): patch pytantan CMakeLists to scrub AVX2 at the source

[nextgenusfs]

Why

PR #67 pinned pytantan to v0.1.3 and rebuilt it from source with
SKBUILD_CMAKE_ARGS='-DHAVE_AVX2:BOOL=OFF;-DAVX2_C_FLAGS:STRING='. That env
var is a real scikit-build-core knob (it maps to cmake.args), but the
published :latest image proved that the override did not survive into the
final build: container inspection shows a populated pytantan/platform/avx2.so
and pytantan/lib.so with 3,404 AVX/AVX2 instruction hits. As a result
import pytantan SIGILLs under Rosetta 2 on Apple Silicon even on macOS 15.6
with the Apple Virtualization Framework + Rosetta-x86 enabled.

The in-Dockerfile guard added in PR #67 was supposed to catch this and fail
the build, but it didn't — most likely a stale BuildKit GHA layer was reused.

What

Replace the single SKBUILD_CMAKE_ARGS-only rebuild with three independent
gates so no single failure can reintroduce AVX2:

1. Source patch. Clone pytantan v${PYTANTAN_VERSION} and run a small
   Python script that walks the top-level and src/pytantan/platform/
CMakeLists.txt, deletes every if(HAVE_SSE4|HAVE_AVX2|HAVE_NEON) ... endif() block (nesting-aware — pytantan's blocks contain a nested
   if(IMPL_FLAGS), so a naive non-greedy regex would mis-balance), and
   removes the corresponding Find*.cmake include() lines. After the
   patch, only the scalar generic Cython extension is in the build graph
   and add_compile_options(-mavx2) is not reachable from any code path.
2. Real config-settings. Invoke pip with both
   --config-settings=cmake.define.HAVE_{SSE4,AVX2,NEON}=OFF (direct pip
   plumbing) and CMAKE_ARGS=... (standard CMake env), as belt-and-braces.
3. Cache invalidation. Add ARG PYTANTAN_CACHEBUST (exposed as ENV
   _PT_CACHEBUST inside the RUN) so the layer hash changes when bumped,
   defeating GHA layer reuse that could otherwise mask a broken rebuild.

Also strengthens the verification step: it now enumerates every .so under
the pixi env, prints per-file AVX hit counts to the build log (visible on
success), and fails on any positive count using a broader mnemonic set
(vpbroadcast, vfmadd, vpermd, vpgatherdd, vextracti128/vinserti128,
ymm*, zmm*).

Verification done locally

The Python patcher was sanity-checked against a fresh clone of
althonos/pytantan@v0.1.3. After patching:

• Root CMakeLists.txt ends up with set(HAVE_SSE4 OFF) / set(HAVE_AVX2 OFF) /
  set(HAVE_NEON OFF) lines in place of the three SIMD blocks, and the
  Find{SSE4,AVX2,NEON}.cmake includes are gone.
• src/pytantan/platform/CMakeLists.txt contains only the generic
cython_extension(...) call — the conditional sse4/avx2/neon
  extensions are gone.

Follow-up after merge

1. Run Actions → Build and Publish Docker Image → Run workflow on main
   (push=true) to overwrite :latest.
2. In a fresh nextgenusfs/funannotate2:latest:

   python -c "import pytantan; from pytantan.lib import RepeatFinder; print('OK', pytantan.__version__)"
   

   Should now print OK 0.1.3 instead of SIGILLing.

---

Pull Request opened by Augment Code with guidance from the PR author