fix(build): apt bins to app stage, per-binary COPYs, no more lost runtime deps (closes #149)

[initializ-mk]

Closes #149. Stacked on top of #148.

Summary

apt-installed binaries declared by skills were silently lost in the runtime image. The bundled `code-review` skill needs `curl`, `git`, `jq`, `gh` — only `gh` survived. Any skill script calling `curl`/`git`/`jq` would log "command not found" at runtime.

Also addressed: the wholesale-directory `COPY --from=bins /usr/local/bin/ /usr/local/bin/` that masked the bug — replaced with explicit per-binary `COPY` lines for every binary that reaches the app stage.

Root cause

The pre-fix flow put every skill bin through a single shared `bins` stage:

```
FROM debian:bookworm-slim AS bins
RUN apt-get install -y curl git jq # ← apt lands these at /usr/bin/
RUN curl ... | tar xz ... && mv .../gh /usr/local/bin/gh

--- Application stage ---

COPY --from=bins /usr/local/bin/ /usr/local/bin/ # ← only catches gh
```

apt drops binaries at `/usr/bin/` per Debian convention, with transitive deps in `/usr/lib/`, `/etc/`. Copying just `/usr/local/bin/` from the bins stage left them behind. And even a per-binary `COPY --from=bins /usr/bin/git` wouldn't work because git depends on `/usr/lib/git-core/` and other support files.

Fix

Restructured `packaging.GenerateDockerfile` to return a structured `DockerfileFragments` separating concerns by install method:

Install method	Where it lives now
apt / apk	Runtime install in the application stage — apt's dep resolution handles libs + config.
direct-URL (kubectl, etc.)	Bins stage download + per-binary `COPY --from=bins /path /path` in app stage.
custom-RUN (gh tarball etc.)	Bins stage + per-binary `COPY --from=bins`.
image-copy (playwright etc.)	Per-binary `COPY --from=bin-` from the dedicated companion stage — no bins-stage intermediate hop.
local-file	Per-binary `COPY .local-bins/` in app stage — no bins stage needed.

`DockerfileFragments` exposes:

```go
type DockerfileFragments struct {
PreAppStages string // companion image-copy stages + shared bins stage
RuntimeAptPackages []string // app stage installs
RuntimeApkPackages []string // app stage installs (alpine)
BinCopies []string // explicit per-binary COPY lines for app stage
PathExtensions []string
}
```

The bins stage's apt install is now strictly `curl ca-certificates` (build-time helpers only), scoped to the stage and never propagating to the runtime image.

End-to-end repro

aibuilderdemo (declares curl/git/jq via apt, gh via custom-RUN):

	Pre-fix	Post-fix
Bins-stage apt install	`curl git jq` (runtime bins routed through wrong stage)	`curl ca-certificates` (build-time only)
App-stage `COPY --from=bins`	wholesale `/usr/local/bin/` (loses /usr/bin contents)	`COPY --from=bins /usr/local/bin/gh /usr/local/bin/gh` (per-binary)
App-stage apt install	`ca-certificates` only	`ca-certificates curl git jq` (runtime deps in app stage)
Binaries in runtime image	gh, forge, ca-certificates (curl/git/jq missing)	gh, forge, curl, git, jq, ca-certificates ✓

Generated app-stage excerpt post-fix:

```
WORKDIR /app
COPY --from=bins /usr/local/bin/gh /usr/local/bin/gh
COPY . .
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git jq && rm -rf /var/lib/apt/lists/*
```

Files changed

• `forge-core/packaging/dockerfile_generator.go` — restructured to return `DockerfileFragments`; apt/apk routed to runtime, per-binary COPYs collected for app stage, image-copy bypasses bins
• `forge-core/packaging/dockerfile_generator_test.go` — rewrote tests against the new contract per install method, plus a regression test pinning the bundled code-review skill shape (`TestGenerateDockerfile_MixedAptAndDirectURL`)
• `forge-core/compiler/template_data.go` — added `BinCopies`, `RuntimeAptPackages`, `RuntimeApkPackages`, `PathExtensions` fields
• `forge-cli/build/dockerfile_stage.go` — populates the new fields from the fragments
• `forge-cli/templates/Dockerfile.tmpl` — replaced wholesale-directory `COPY` with a per-binary loop; runtime apt/apk packages installed in the app stage; PATH extensions emitted at end

Test plan

• `go test ./...` from `forge-skills/`, `forge-core/`, `forge-cli/` — all pass
• `golangci-lint run` — 0 issues
• End-to-end build on `aibuilderdemo` — Dockerfile inspected by hand; matches the post-fix shape above
• Regression test `TestGenerateDockerfile_MixedAptAndDirectURL` covers the exact bundled-skill shape that triggered the bug
• Per-install-method tests confirm: apt-only manifests produce zero bins stage, direct-URL manifests produce a bins stage + per-binary COPYs, image-copy manifests skip bins entirely

Out of scope

• Multi-arch image-copy from upstream single-binary images (e.g. `alpine/git`). Registry-level decision per binary, tracked separately.
• The `forge` binary install is independent of the bins/app split — still installed inline in the app stage via `curl | tar` and not touched.

Stacked on

This PR targets the `fix/issue-147-build-output` branch (PR #148) rather than `main` so the `Dockerfile.tmpl` changes from #148 don't conflict. Will rebase to `main` after #148 merges.