#9 - Build xberg PHP extension alongside kreuzberg in 8.5 image

[nikola-jovanovic-php]

Closes #9

Changes (8.5/Dockerfile only)

• New xberg-builder stage: builds crates/xberg-php from xberg-io/xberg at pinned v1.0.0-rc.28 (no stable tag exists yet — bump XBERG_VERSION when one lands), same shape and retry loop as the kreuzberg stage. xberg vendors Tesseract statically (no libtesseract-dev needed), but its heic feature links system libheif ≥ 1.21, so the stage builds libheif 1.23.0 from source (trixie apt ships 1.19.8) — mirroring xberg's own CI.
• Final image: ships xberg.so commented out in conf.d/xberg.ini (same pattern as kreuzberg), copies libheif.so.1 to /usr/local/lib (on LD_LIBRARY_PATH), and adds the codec runtime packages (libde265-0 libaom3 libx265-215 libdav1d7 libnuma1) so the extension is loadable when consumers enable it.
• Fix: kreuzberg clone URL now points to kreuzberg-dev/kreuzberg-lts — the old repo was renamed to xberg-io/xberg, so the v4.9.8 clone fails and uncached 8.5 builds are currently broken on master. Same pinned version, same crate layout.
• Kreuzberg stage otherwise untouched — kept during the transition (v4 LTS until end of 2026); remove once downstream migrations (sctr/api.bang.com#5235) complete.

Verification (local arm64 build)

• Full docker build succeeds; xberg compile ≈ 18 min native.
• extension=xberg enabled → php -m lists xberg; class_exists('Xberg\CacheStats') → true.
• ldd xberg.so: zero unresolved libs; libheif.so.1 resolves to the bundled 1.23 copy. kreuzberg.so still fully resolved.
• Both extensions enabled simultaneously load side by side.
• Image size: 2.38 GB vs 2.04 GB current 8.5-arm64 (+~340 MB — the .so statically bundles ONNX/candle/Tesseract).