fix: require libcurl 8.22.0 for TLS shutdown cleanup

[loks0n]

Require libcurl 8.22.0 in the build and runtime images. Version 8.21.0 can retain TLS shutdown connections when driven through the socket-action API used by Swoole's curl hook, causing socket and memory growth. Alpine 3.24 now ships the upstream fix, so no source backport is needed.

The container structure test checks PHP's loaded libcurl version and rejects the existing Cloud image (8.21.0).

Validation:

• All CI checks passed, including AMD64/ARM64 production and XDebug builds, structure tests, tooling verification, image efficiency, and security scan.
• All 16 structure tests passed locally against the exact CI-built ARM64 image.
• Loaded the production Cloud vendor tree and unchanged Span bootstrap onto that image: 2,400/2,400 synthetic Sentry events delivered, zero exporter errors. FDs started at 8, peaked at 26, and ended at 14 before destroying the client; 5 CLOSE_WAIT sockets remained at that sample, with no accumulating trend. Anonymous RSS ranged 17,996–18,504 KiB through the second half. The original 8.21.0 reproduction accumulated 400 CLOSE_WAIT sockets and 411 FDs after 400 events.
• Keep-alive: 400/400 delivered, zero exporter errors, one TCP connection.
• Docker build checks passed with no warnings. Local source builds encountered a PECL download timeout; behavioral validation used the CI-built image. An earlier soak run during compilation had seven connection timeouts and was not counted as passing; the completed-image run used the same timeout settings and passed.

This is a local transport regression test, not a production performance benchmark. No staging or production deployment is included in this PR.

Upstream: curl/curl#22282 and curl/curl@820c014.

[greptile-apps]

Greptile Summary

This PR raises the minimum libcurl version in both compilation and runtime stages to include the TLS shutdown cleanup fix and adds a production-image structure test that verifies PHP loads libcurl 8.22.0 or newer.

• Requires compatible curl development headers when compiling Swoole curl-hook support.
• Requires the fixed libcurl version in the final runtime image.
• Verifies the loaded runtime version through PHP’s curl extension.

Confidence Score: 5/5

The PR appears safe to merge because the build enforces the required libcurl floor and the production structure test validates the loaded runtime version.

No actionable failures remain: unavailable packages fail image construction rather than producing a vulnerable image, and the runtime assertion checks the library loaded in the freshly built production target.

Important Files Changed

Filename	Overview
Dockerfile	Aligns compile-time curl headers and the final runtime library on a minimum fixed libcurl version.
tests.yaml	Adds a focused production-image assertion for the libcurl version actually loaded by PHP.

_{Reviews (1): Last reviewed commit: "fix: require libcurl 8.22.0 for TLS shut..." | Re-trigger Greptile}