fix(docker): actually disable pytantan SIMD via scikit-build-core config-settings

[nextgenusfs]

Problem

PR #65 attempted to disable AVX2 in the in-Dockerfile pytantan rebuild by setting CMAKE_ARGS="-DHAVE_AVX2=OFF ..." as a shell env-var when invoking pip. scikit-build-core (pytantan's build backend) filters CMAKE_ARGS inconsistently, and the HAVE_AVX2 override never reached the inner CMake invocation. The published image still shipped pytantan/platform/avx2.*.so and SIGILLed at import pytantan under Rosetta 2 on Apple Silicon:

>>> import pytantan
Illegal instruction

(Reported against sha256:e21a45c4aebc5d756179b3e772a9bbb0eb96e544e6c5c5d89538a73908d154dc, the :latest tag at the time of writing.)

Fix

Switch to scikit-build-core's documented channel for forwarding -D options:

pip install \
    --config-settings=cmake.define.HAVE_AVX2=OFF \
    --config-settings=cmake.define.HAVE_SSE4=OFF \
    --config-settings=cmake.define.HAVE_NEON=OFF \
    ...

These land directly on the inner cmake command line and short-circuit pytantan's FindAVX2.cmake via its if(DEFINED HAVE_AVX2) guard, so the build skips pytantan/platform/avx2.*.so entirely and pytantan's runtime dispatch falls back to the pure-C++ generic backend.

Guard rails

Add an in-Dockerfile verification step so silent regressions can never publish another broken image:

1. Hard-fail if pytantan/platform/{avx2,sse4,neon}*.so exists after the rebuild.
2. objdump -d -M intel every .so under the pytantan install dir and hard-fail if any of ymm[0-9]+, zmm[0-9]+, vpbroadcast*, vextracti128, vinserti128 appear.
3. python -c "from pytantan import Alphabet, RepeatFinder, default_scoring_matrix" to exercise the public dispatch path.

If any guard trips, the Docker build fails and no broken image is published.

Test plan

• CI builds the image and the three guards above must pass.
• After the published image lands, validate on M-series Mac:

  docker pull nextgenusfs/funannotate2:latest
  docker run --rm --platform=linux/amd64 nextgenusfs/funannotate2:latest \
      python -c "import pytantan; print('OK')"
  

Supersedes #65 (which I'm closing).

---

Pull Request opened by Augment Code with guidance from the PR author

[nextgenusfs]

Closing — no Dockerfile changes are needed.

The Dockerfile on main (post-#65) already has identical fixes: scikit-build-core --config-settings=cmake.define.HAVE_*=OFF, the file-presence guard for pytantan/platform/{avx2,sse4,neon}*.so, and the objdump guard for AVX/AVX-512 mnemonics. The diff between this branch and main is cosmetic only.

The real reason docker pull nextgenusfs/funannotate2:latest still SIGILLs on the M3 Mac is that the publish workflow never ran for the merge of #65 — .github/workflows/docker.yml only pushes images on push: tags: ['v*'] or workflow_dispatch, not on merge-to-main. The :latest tag still points at the pre-#65 image that ships pytantan/platform/avx2.*.so.

Fix is to publish a new :latest: either cut a release tag, or trigger the workflow manually from the Actions tab with Run workflow (push=true) on main.