Pull MinIO from pgsty/silo instead of building it from source

[sgamelin]

What does this change do, and why?

This switches the minio compose service from building MinIO and mc from source (etc/minio/Dockerfile, now removed) to the pgsty/silo image, pinned by digest. pgsty/silo is a community-maintained AGPLv3 fork of MinIO that still publishes images.

The source build downloads and compiles about 241 Go modules on every just ci and every smoke leg. As measured in #777, that takes about 2 minutes on a typical runner and up to 9½ on a slow one. It also bounced #787 from the merge queue: all three failed smoke legs died in go build on stream error: INTERNAL_ERROR from proxy.golang.org (run).

• The image covers linux/amd64 and linux/arm64. It has mc at /usr/bin/mc and has bash, so the compose healthcheck and the justfile's minio-* recipes run unchanged. Its entrypoint maps the existing server /data ... command to its silo binary. The service keeps the name minio, so AWS_ENDPOINT and every recipe work unchanged.
• smoke brings up nisshi-io/example-java's compose file, so its pin moves to example-java#5, which makes the same switch. The pin is Bump clap from 4.5.11 to 4.5.16 #5's head commit. example-java merges with merge commits, so the pin stays reachable from its main once Bump clap from 4.5.11 to 4.5.16 #5 lands.
• Pulling a public image means we don't redistribute MinIO ourselves. Publishing our own build to a public GHCR package would count as conveying under the AGPL, and we'd owe the Corresponding Source for as long as the image is up.

How was this tested?

Locally, with this compose.yaml:

• just ci came up healthy in 21 s, including Lakekeeper creating its warehouse on the lake bucket.
• mc ready local, mc alias set and mc mb pass.
• Conditional writes work, which the s3:// engine relies on: a second PutObject with If-None-Match: * and one with a wrong If-Match both return PreconditionFailed, and the correct If-Match succeeds.
• ghcr.io/nisshi-io/nisshi:main on --storage-engine s3://nisshi/ created a topic and produced 500 idempotent records, and a consumer group read all 500 back.

In example-java#5's CI, which runs the same flow as smoke:

• All six s3://nisshi/ legs pass on amd64 and arm64.
• docker compose up took 9 to 14 s per leg, against 102 to 160 s on example-java's last main run.
• The postgres:// legs fail in the bats step, as they do on example-java's main, because of its schema drift. smoke isn't affected because it copies nisshi's schema in first.

This PR's test job runs the full suite, including the berg tests, against silo through just ci. smoke runs in the merge queue.

Checklist

• Commits are signed off (git commit -s) — see CONTRIBUTING.md
• just fmt, just clippy, and just test pass locally. Not run: this changes no Rust code, and this PR's test job runs the suite against silo.
• Tests added or updated for the behavior changed. Not applicable: this is CI and dev infrastructure only.
• Docs updated if user-facing behavior changed. Not applicable.

🤖 Generated with Claude Code

[solace-aross]

Approving. I checked the swap by running the image, not just reading the diff.

What I verified:

• Digest matches the tag. Docker Hub resolves pgsty/silo:RELEASE.2026-09-16T00-00-00Z to sha256:635197cb…a46, an OCI index with linux/amd64 and linux/arm64 (plus attestation entries). The pin can't drift underneath us.
• The image behaves the way compose and the justfile need. I ran the pinned digest locally (podman) with compose's server /data --console-address ":9001". The entrypoint maps it to silo. /usr/bin/mc and bash are present, and mc ready local, mc alias set and mc mb local/nisshi all succeed.
• The healthcheck isn't passing vacuously. Compose's bash -c ':> /dev/tcp/127.0.0.1/9000' reports healthy against silo. The same probe pointed at a dead port (9999) fails with Connection refused, so the --wait gates in just ci are really checking the server.
• CI used silo. In this PR's test (postgres:17) job, minio Pulled takes 1.6 s, then healthy, then both buckets are created, then 1052 tests run: 1052 passed with STORAGE_ENGINE: s3://nisshi/.
• Nothing else refers to etc/minio. A git grep at the head finds no leftover build: etc/minio or Dockerfile path references.

One note, not blocking:

• The smoke pin (65bfbfd) is example-java#5's head, and #5 is still open. The commit stays fetchable through refs/pull/5/head, so checkout won't break. But if #5 changes before it merges, nisshi's smoke keeps testing the old compose file. Consider merging example-java#5 first, or re-pinning to its merge commit afterwards. smoke only runs in the merge queue, so this PR's green checks don't cover that leg yet.