Bundle go-pmtiles into the Docker image

The "Regenerate for current view" build was failing in production with
"could not run 'pmtiles'" — go-pmtiles was never actually installed
anywhere, just documented as something a developer runs by hand
locally (docs/development.adoc). Installs the static Linux binary from
go-pmtiles' own GitHub releases, architecture-matched via dpkg rather
than hardcoded amd64.

Verified the exact download/extract/exec sequence end-to-end outside
Docker (no daemon available in this sandbox to run a real build).

Dockerfile

@@ -3,9 +3,29 @@ FROM ruby:4.0.6-slim-bookworm
 # build-essential: puma has a native (C) extension; harmless if the
 # platform-specific gem in Gemfile.lock already has a precompiled binary
 # matching this base image, but keeps the build working if it doesn't.
-RUN apt-get update && apt-get install --no-install-recommends -y build-essential \
+# ca-certificates/curl: needed for the go-pmtiles download below (also
+# handy for anyone debugging inside a running container).
+RUN apt-get update && apt-get install --no-install-recommends -y build-essential ca-certificates curl \
   && rm -rf /var/lib/apt/lists/*
 
+# The `pmtiles` CLI (lib/maptool/pmtiles_builder.rb's "Regenerate for
+# current view" — see docs/development.adoc) — no Debian package exists,
+# so this pulls the static binary straight from its own GitHub releases.
+# Architecture-matched (Debian's dpkg arch name translated to the release
+# asset's own naming) rather than hardcoded amd64, so this still works
+# building on an arm64 host. Pinned, like every other dependency in this
+# repo (Gemfile, docs/third-party-notices.adoc) — bump PMTILES_VERSION
+# deliberately, not via `latest`.
+ARG PMTILES_VERSION=1.31.2
+RUN set -eux; \
+  case "$(dpkg --print-architecture)" in \
+    amd64) pmtiles_arch=x86_64 ;; \
+    arm64) pmtiles_arch=arm64 ;; \
+    *) echo "unsupported architecture for go-pmtiles: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+  esac; \
+  curl -fsSL "https://github.com/protomaps/go-pmtiles/releases/download/v${PMTILES_VERSION}/go-pmtiles_${PMTILES_VERSION}_Linux_${pmtiles_arch}.tar.gz" \
+    | tar xz -C /usr/local/bin pmtiles
+
 WORKDIR /app
 
 COPY Gemfile Gemfile.lock ./

docs/third-party-notices.adoc

@@ -82,6 +82,24 @@ The online map style (not vendored, fetched at runtime when the
 https://tiles.openfreemap.org/styles/liberty[OpenFreeMap "liberty"],
 built from https://www.openstreetmap.org[OpenStreetMap] data.
 
+Not a frontend asset like the above, but also baked into this app's own
+Docker image (not a separate container the way kiwix-serve/gpsd are —
+see `docs/deployment.adoc`/`docs/development.adoc`): the `pmtiles` CLI
+(`go-pmtiles`), installed as a static binary in the `Dockerfile` for
+`lib/maptool/pmtiles_builder.rb`'s in-app offline.pmtiles/terrain.pmtiles
+regeneration. BSD-3-Clause, same as pmtiles.js/MapLibre GL above.
+
+[cols="1,1,2"]
+|===
+| Tool | Version | Source
+
+| go-pmtiles (`pmtiles` CLI)
+| 1.31.2
+| https://github.com/protomaps/go-pmtiles
+|===
+
 To update a vendored library: download its package (e.g.
 `npm pack <name>@<version>`), replace the corresponding files under
-`public/vendor/<name>/`, and update the version in this file.
+`public/vendor/<name>/`, and update the version in this file. To
+update go-pmtiles, bump `PMTILES_VERSION` in the `Dockerfile` and the
+version here.