feat(ci): unified image repo with shared builder and tag-based variants

[chaodu-agent]

Summary

Consolidate all Docker images into a single repo (ghcr.io/openabdev/openab) with tag-based variants.

Closes #1174

Changes

Dockerfile.unified

• Shared builder stage: compiles the openab binary once in unified mode (superset)
• Per-agent targets: 14 thin runtime layers that only install the agent CLI
• Also compiles openab-agent (for native) and agy-acp (for antigravity) in the builder

.github/workflows/build-images.yml

New workflow replacing the per-variant approach in snapshot-build.yml:

• Job 1 (build-core): shared Rust builder, 1× per arch (~8-10 min)
• Job 2 (build-agents): 14 agent variants in parallel, thin layers (~2 min each)
• Job 3 (merge-manifests): multi-arch manifest per variant (~1 min)

Tag strategy

ghcr.io/openabdev/openab:<version>-<agent>   # per agent
ghcr.io/openabdev/openab:<version>           # default (kiro)
ghcr.io/openabdev/openab:latest              # latest default

Agents

kiro, claude, codex, copilot, cursor, gemini, grok, hermes, mimocode, opencode, antigravity, pi, native, agentcore

Performance

~12 min total build time (vs ~140 min today with 14 independent builds)

What's NOT in this PR (follow-ups)

• Deprecate/remove old snapshot-build.yml (after validation)
• Remove individual Dockerfile.<agent> files (after migration period)
• Update Helm chart _helpers.tpl to use <tag>-<agent> format
• Update docs

[chaodu-agent]

LGTM ✅ — Unified image build is architecturally sound, security-hardened, and ready to merge.

What This PR Does

Consolidates 14+ separate Docker images (openab-claude, openab-codex, etc.) into a single repo (ghcr.io/openabdev/openab) with tag-based variants, reducing total CI build time from ~140 min to ~12 min.

How It Works

• Dockerfile.unified: Multi-target Dockerfile with a shared builder stage (compiles once in unified mode) and 14 thin agent runtime targets
• build-images.yml: 4-job workflow — resolve matrix → build-core (1× per arch) → build-agents (14× parallel thin layers) → merge-manifests (multi-arch)
• docker-smoke-test-unified.yml: PR-triggered validation of all 14 unified targets
• Tag strategy: <version>-<agent>, <version> (default=kiro), latest (main only)

Findings

#	Severity	Finding	Location
1	🟢	Registry-based builder avoids redundant Rust compilations across 28 matrix jobs	build-images.yml:build-core
2	🟢	Native arch runners (amd64 + arm64) avoid QEMU emulation overhead	build-images.yml:build-agents
3	🟢	Script injection hardened — all inputs passed via env: not direct interpolation	build-images.yml:matrix
4	🟢	:latest branch guard prevents non-main overwrites	build-images.yml:merge-manifests
5	🟢	Input validation (tag format regex + variant allowlist + latest blocked)	build-images.yml:matrix
6	🟢	Concurrency group prevents tag race conditions	build-images.yml:L14-16
7	🟢	Digest count + hex format validation before manifest creation	build-images.yml:merge-manifests
8	🟢	Cache-busting fix: openab-agent/ and agy-acp/ copied after main build	Dockerfile.unified:builder
9	🟢	PR-triggered smoke test covers all 14 unified targets	docker-smoke-test-unified.yml

Follow-up Items (non-blocking)

• Builder intermediate images (ghcr.io/.../builder:<tag>-<arch>) will accumulate — add retention/cleanup policy
• matrix job lacks explicit permissions block (inherits GHA defaults)
• Digest count hardcoded to 2 — update if adding a third platform in the future
• Unified smoke test could add ACP handshake verification (matches legacy smoke test)
• Consider SBOM/provenance attestation for supply chain hardening
• Deprecate/remove old snapshot-build.yml and individual Dockerfile.<agent> files after migration period
• Update Helm chart _helpers.tpl to use <tag>-<agent> format

What's Good (🟢)

• Massive build time reduction: ~140 min → ~12 min by compiling once and packaging 14 thin layers in parallel
• Security hardened: script injection prevention, input validation, branch guards, digest verification
• Multi-arch done right: native runners + push-by-digest + imagetools manifest creation
• Robust cache strategy: registry-based builder reuse + GHA cache as fallback
• Complete validation: PR-triggered smoke test ensures no broken targets merge