address Copilot review findings on PR #145

- Pin busybox by image-index digest
  (sha256:19b646668802469d968a05342a601e78da4322a414a7c09b1c9ee25165042138)
  so the build is reproducible across upstream tag rebuilds. buildx
  multi-arch resolver picks the right platform manifest from the
  index automatically. Verified busybox 1.37.0's nsenter applet
  supports -t/--target, -m/--mount, -u/--uts, -i/--ipc, -n/--net,
  -p/--pid — the exact flags SpawnNsenter emits.
- Restore /proc/1/root/usr/sbin/nsenter and /proc/1/root/sbin/nsenter
  to the candidate list so the host-fallback search mirrors the
  container-local list (which already includes /usr/sbin and /sbin).
- "binary not found" error now reports the actual list searched
  (built from the candidates slice) instead of the stale
  "/proc/1/root and /usr/bin" string.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox-agent/Dockerfile

@@ -46,7 +46,14 @@ COPY --from=go-builder --chown=65532:65532 /var/lib/gearbox-agent /var/lib/gearb
 # mount namespace. busybox is statically linked, ~1MB, and dispatches
 # applets by argv[0], so dropping it in as /usr/bin/nsenter is enough.
 # Operators not running host-exec mode pay only the 1MB image cost.
-COPY --from=busybox:1.37.0-musl /bin/busybox /usr/bin/nsenter
+#
+# Pinned by index digest (not just tag) so the build is reproducible
+# across busybox tag rebuilds. The buildx multi-arch resolver picks
+# the right platform manifest from this index automatically. busybox
+# 1.37.0's nsenter applet supports -t/--target, -m/--mount,
+# -u/--uts, -i/--ipc, -n/--net, -p/--pid (which is what SpawnNsenter
+# emits); verified against the upstream applet list before pinning.
+COPY --from=busybox:1.37.0-musl@sha256:19b646668802469d968a05342a601e78da4322a414a7c09b1c9ee25165042138 /bin/busybox /usr/bin/nsenter
 
 # Expose API port
 EXPOSE 8405

gearbox-agent/internal/api/console/pty/nsenter_linux.go

@@ -132,8 +132,12 @@ var nsenterCandidates = []string{
 	"/sbin/nsenter",
 	// Host fallback via /proc/1/root — only loads when libc paths
 	// happen to line up. Kept for completeness; never relied on.
+	// Mirrors the container-local list (incl. sbin) so non-distroless
+	// agent flavors that match host layout get parity coverage.
 	"/proc/1/root/usr/bin/nsenter",
 	"/proc/1/root/bin/nsenter",
+	"/proc/1/root/usr/sbin/nsenter",
+	"/proc/1/root/sbin/nsenter",
 }
 
 // resolveHostNsenter returns the first reachable nsenter binary path,
@@ -171,7 +175,7 @@ func SpawnNsenter(ctx context.Context, command []string, runAs string, cols, row
 	}
 	nsenterBin := resolveHostNsenter()
 	if nsenterBin == "" {
-		return nil, errors.New("nsenter: binary not found (looked under /proc/1/root and /usr/bin)")
+		return nil, fmt.Errorf("nsenter: binary not found (searched %v)", nsenterCandidates)
 	}
 	argv := append([]string{
 		nsenterBin,