I came across a link problem in building the static wapptclsh in Debian 11 using Tcl 8.7a6 which is triggered iff you have installed the Debian libtommath-dev package. Tcl TIP https://core.tcl-lang.org/tips/doc/trunk/tip/538.md explains that recent versions of Tcl 8.7 will use a system libtommath library (>= version 1.2.0) if it exists, but otherwise use the older internal Tcl version of tommath.

The fix is shown in the Makefile below, slightly adjusted from the canonical version:

#!/usr/bin/make

TCLDIR = $(HOME)/path/to/tcl-build/prefix
# For static build, Tcl configuration for build (./configure ...)
#  must use "--disable-shared"
CFLAGS = -Os -static
CC = gcc
OPTS = -DSQLITE_ENABLE_DESERIALIZE
# If have system libtommath >= 1.2.0 (e.g. because sudo apt install 
# libtommath-dev), uncomment next line:
LIBTOMMATH = -ltommath
TCLLIB = $(TCLDIR)/lib/libtcl8.7.a $(LIBTOMMATH) -lm -lz -lpthread -ldl
TCLINC = $(TCLDIR)/include
TCLSH = tclsh

all: wapptclsh

wapptclsh: wapptclsh.c
	$(CC) $(CFLAGS) -I. -I$(TCLINC) -o $@ $(OPTS) wapptclsh.c $(TCLLIB)

wapptclsh.c:	wapptclsh.c.in wapp.tcl wapptclsh.tcl tclsqlite3.c mkccode.tcl
	$(TCLSH) mkccode.tcl wapptclsh.c.in >$@

clean:	
	rm wapptclsh wapptclsh.c

On amd64 Debian 11 this binary is about 5.2MB in size, a little larger than a docker Alpine musl libc based static build.

In a chroot jail, you could place the wapptclsh binary into bin/. The only extra requirement is to add the current version of glibc to the chroot jail, which currently is /lib/x86_64-linux-gnu/libc-2.31.so on amd64 Debian 11, or something similar. This must be added into the chroot under lib/x86_64-linux-gnu/.