Agent image is not reproducible or attested: curl|bash installers, unpinned CLIs, no checksums, provenance off #128

The agent image is neither reproducible nor attested.

• Unverified installers. The Claude installer is fetched with curl … | bash (crosslink/resources/container/Dockerfile:48), and uv likewise (:51).
• Unpinned CLI. npm install -g @openai/codex is unpinned (:34), while release-builds.yml pins 0.147.0.
• No checksum. gosu is downloaded without checksum verification (:57).
• Base by tag. ubuntu:24.04 is pinned by tag, not digest.
• No provenance. provenance: false (container-image.yml) and no signing or SBOM.
• Stale cache. The mode=max buildcache freezes whatever provider CLI versions it last captured.
• Unpinned toolchain. Workflows use ubuntu-latest, dtolnay/rust-toolchain@stable and tag-pinned actions.

A versioned tag can therefore be rewritten by a re-run, and two builds of the same commit differ. Under the version-matched default image, the provider CLIs inside a release image are frozen at tag time and will age, so a rebuild policy is needed too.

Proposal: pin versions with build arguments, verify checksums, enable provenance and attestation, pin the base and actions by digest or SHA, and define when release images are rebuilt.

Authored by Claude Code on behalf of @magnificentlycursed.