fix(agent-runtime): slim base to shim + Node/git/tini (drop workspace-init build) (#109)

packages/workspace-strategy is not on fork main and git workspace population is
out of the current blank-workspace sandbox-cr scope, so the base no longer builds
tools/workspace-init. opencode/pi only need Node+git+tini+user on top of the shim.

Author: stubbi

docker/agent-runtime/Dockerfile.base

@@ -10,26 +10,14 @@ COPY tools/agent-shim/ ./
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
     go build -ldflags='-s -w' -o /out/paperclip-agent-shim .
 
-# ---------- Stage 2: build workspace-init (Node) ----------
-FROM node:${NODE_VERSION}-bookworm-slim AS wsinit-build
-WORKDIR /src
-COPY pnpm-lock.yaml package.json pnpm-workspace.yaml tsconfig.base.json ./
-# Repo root pnpm config has patchedDependencies referencing ./patches/* — copy
-# the patch files so `pnpm install --frozen-lockfile` does not ENOENT on them
-# even though we install zero workspaces that consume embedded-postgres.
-COPY patches/ ./patches/
-COPY packages/workspace-strategy/ ./packages/workspace-strategy/
-COPY tools/workspace-init/ ./tools/workspace-init/
-RUN corepack enable && pnpm install --frozen-lockfile \
-    && pnpm --filter @paperclipai/workspace-strategy build \
-    && pnpm --filter @paperclipai/workspace-init build \
-    # Materialize publishConfig into the live package.json so that Node's
-    # production module resolution targets dist/ instead of src/*.ts. This
-    # mirrors what `pnpm publish` does, but for our local consumption inside
-    # the runtime image where TypeScript loaders are not present.
-    && node -e "const f='packages/workspace-strategy/package.json';const p=JSON.parse(require('fs').readFileSync(f,'utf8'));if(p.publishConfig&&p.publishConfig.exports){p.exports=p.publishConfig.exports;}require('fs').writeFileSync(f,JSON.stringify(p,null,2)+'\n');"
-
-# ---------- Stage 3: runtime base image ----------
+# ---------- Stage 2: runtime base image ----------
+# Ubuntu + Node + git + tini + non-root paperclip user + the agent-shim. This is
+# everything the sandbox-cr exec-in model needs: the pod idles (sleep infinity)
+# and paperclip-server execs the harness CLI in, so the harness images only add
+# their CLI on top of this. workspace-init / workspace-strategy (git workspace
+# population for the future job backend) are intentionally NOT built here yet:
+# the current cloud scope is a blank workspace, and packages/workspace-strategy
+# is not on fork main. Add them back when git workspace population lands.
 FROM ubuntu:22.04 AS base
 ARG NODE_VERSION
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -44,23 +32,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 COPY --from=shim-build   /out/paperclip-agent-shim                          /usr/local/bin/paperclip-agent-shim
 
-# workspace-init resolves @paperclipai/workspace-strategy via a pnpm workspace
-# symlink (tools/workspace-init/node_modules/@paperclipai/workspace-strategy ->
-# ../../../../packages/workspace-strategy). Mirror the /src layout under
-# /opt/paperclip/app so Node's module resolution and that relative symlink
-# both keep working at runtime.
-COPY --from=wsinit-build /src/tools/workspace-init/package.json              /opt/paperclip/app/tools/workspace-init/package.json
-COPY --from=wsinit-build /src/tools/workspace-init/dist                      /opt/paperclip/app/tools/workspace-init/dist
-COPY --from=wsinit-build /src/tools/workspace-init/node_modules              /opt/paperclip/app/tools/workspace-init/node_modules
-COPY --from=wsinit-build /src/packages/workspace-strategy/package.json       /opt/paperclip/app/packages/workspace-strategy/package.json
-COPY --from=wsinit-build /src/packages/workspace-strategy/dist               /opt/paperclip/app/packages/workspace-strategy/dist
-COPY --from=wsinit-build /src/node_modules                                   /opt/paperclip/app/node_modules
-
-# Convenience launcher so the init container can just run `paperclip-workspace-init`
-RUN printf '#!/bin/sh\nexec node --enable-source-maps /opt/paperclip/app/tools/workspace-init/dist/index.js "$@"\n' \
-      > /usr/local/bin/paperclip-workspace-init \
-    && chmod +x /usr/local/bin/paperclip-workspace-init
-
 USER 1000:1000
 WORKDIR /workspace
 ENTRYPOINT ["/usr/bin/tini", "--"]