fix(agent): unblock verified image rollout (PEN-2077)

[allyblockcast]

Thinking Path

• Paperclip runs technical agents in restricted Kubernetes Jobs and requires inspectable browser evidence.
• PEN-2077 landed the pinned headless shell and restricted PNG smoke in PR fix(agent): safely restore headless screenshots (PEN-2077) #1028.
• The post-merge agent-image workflow fails before that smoke because the moving FFmpeg publisher stable digest no longer exposes moq_mmt.
• Repeated retries cannot recover while toolchain identity follows the unvalidated moving digest.
• The merged carrier also retained two exact-head safety findings: leaf symlink dereference and index-wrapping promotion.
• This pull request validates the FFmpeg publisher capability with a proven immutable fallback and closes both promotion/entrypoint findings.
• The benefit is a fail-closed, reproducible path to publish and deploy the browser-fixed image without weakening pod security or dropping MMTP capability.

Linked Issues or Issue Description

• Refs PEN-2077
• Refs PEN-2070
• Follow-up to fix(agent): safely restore headless screenshots (PEN-2077) #1028 and superseded source PR fix(agent): restore headless screenshot capture (PEN-2077) #1006.

What Changed

• Validate the resolved FFmpeg publisher digest for moq_mmt before deriving the stable toolchain identity.
• Fall back to digest sha256:be20fcc53b6ca777de62c004ea926bcbb044f766f942e0bbe0eac6ee419a06d1, proven by successful agent-image run 30734374680, when the moving tag regresses.
• Use ln -sfn so a hostile google-chrome leaf symlink cannot redirect entrypoint repair into a directory.
• Promote the verified image with --prefer-index=false so the floating tag preserves the candidate manifest digest.
• Add contract coverage for all three release invariants.

Verification

• pnpm exec vitest run server/src/__tests__/docker-entrypoint.test.ts server/src/__tests__/docker-opencode-runtime-pin.test.ts packages/adapter-utils/src/agent-dockerfile.test.ts (26/26 passed).
• pnpm --filter @paperclipai/server typecheck (passed).
• bash -n scripts/docker-entrypoint.sh (passed).
• git diff --check (passed).
• shellcheck and local Docker build were unavailable in this restricted agent runtime; Docker (agent base) on arc-dind is the authoritative image build and restricted PNG smoke.

Risks

• Blast radius: agent-image publication for Blockcast and Penstock. No running agent changes until the immutable candidate passes the restricted screenshot smoke and the bump step runs.
• The fallback intentionally holds FFmpeg at the last green publisher digest when upstream stable is invalid; a later valid stable digest is selected automatically.
• Rollback: revert this commit. Existing agents remain on sha-cce01e9-k8s-vendored; the workflow never promotes or bumps an image that fails validation.

For core feature work, check ROADMAP.md first and discuss it in #dev before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See CONTRIBUTING.md.

Model Used

• OpenAI openai/gpt-5.6-sol with tool use and code execution.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have run tests locally and they pass
• I have added or updated tests where applicable
• If this change affects the UI, I have included before/after screenshots (not applicable: runtime release path)
• I have updated relevant documentation to reflect my changes (workflow comments document the fallback contract)
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[allyblockcast]

🔗 Paperclip issue: PEN-2070
🔗 Paperclip issue: PEN-2077

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: cb160fe

Important Issues (1)

• [gstack/review, native-codex] .github/workflows/docker-agent.yml:122 — The capability probe combines set -o pipefail with grep -qE. Once grep -q finds moq_mmt, it can close the pipe while docker run is still writing; the producer then exits with SIGPIPE (141), so a valid stable image is treated as invalid. The identical unguarded fallback probe at line 126 can then abort the workflow even though the known-good image contains the muxer. This shell behavior reproduces with a continuing producer under pipefail.
  • Drain the producer instead of exiting early, for example grep -E '...' >/dev/null, or capture the complete docker run output before testing it. Add an executable regression test with substantial output after the matching token.

Suggestions (1)

• [tests] server/src/__tests__/docker-entrypoint.test.ts:142 — The “hostile browser leaf symlink” test stubs ln and never creates a hostile symlink, so it verifies the -n argument but not replacement behavior. A filesystem-level test with a destination symlink to a directory would make the security regression coverage match the test name.

Strengths

• The fallback digest is immutable and included in the derived toolchain identity.
• ln -sfn is the correct implementation change for avoiding destination-symlink dereference.
• Promotion remains gated on the restricted screenshot smoke and an exact digest assertion.

Recommended Action

1. Fix the Important capability-probe issue before merge.
2. Consider the behavioral symlink test opportunistically.

Because this PR is authored by app/allyblockcast, the Ally App cannot review its own PR. After the finding is fixed, this exact head must be reopened under an independent author before an App approval can satisfy review/ally-complete; the shared user token is not gate evidence.