toolinstall: EnsureCommand panics inside singleflight when aqua registry lookup fails

[simonferquel]

Description

toolinstall.EnsureCommand can panic (instead of returning an error) when the aqua registry HTTP fetch fails in certain network-restricted environments. The panic originates inside singleflight.Group.doCall and is recovered+repanicked, crashing the process.

Reproduction

1. Run docker-agent in an environment where outbound HTTPS to raw.githubusercontent.com and api.github.com is blocked or unreliable (e.g. SSRF-protected network, no GitHub token, restrictive firewall).
2. Use an agent config with an LSP toolset whose command is not on PATH and has no version: field (auto-install not disabled):

agents:
  root:
    toolsets:
      - type: lsp
        command: typescript-language-server
        args: ["--stdio"]
        file_types: [".ts", ".tsx", ".js", ".jsx"]

3. teamloader.Load → createLSPTool → toolinstall.EnsureCommand → resolve → singleflight.Group.Do → doInstall panics.

Stack trace

panic(...)
        runtime/panic.go:860 +0x13a
golang.org/x/sync/singleflight.(*Group).doCall.func1()
        golang.org/x/sync@v0.20.0/singleflight/singleflight.go:170 +0x29b
golang.org/x/sync/singleflight.(*Group).doCall(...)
        golang.org/x/sync@v0.20.0/singleflight/singleflight.go:205 +0x99
golang.org/x/sync/singleflight.(*Group).Do(...)
        golang.org/x/sync@v0.20.0/singleflight/singleflight.go:113 +0x155
github.com/docker/docker-agent/pkg/toolinstall.resolve(...)
        github.com/docker/docker-agent@v1.58.0/pkg/toolinstall/resolver.go:62 +0x139
github.com/docker/docker-agent/pkg/toolinstall.EnsureCommand(...)
        github.com/docker/docker-agent@v1.58.0/pkg/toolinstall/resolver.go:33 +0xf5
github.com/docker/docker-agent/pkg/teamloader.createLSPTool(...)
        github.com/docker/docker-agent@v1.58.0/pkg/teamloader/registry.go:457 +0x5a

Expected behaviour

EnsureCommand should return an error when the registry lookup or install fails — never panic. The createMCPTool path already handles EnsureCommand errors gracefully (logs a warning, falls back to the original command name). createLSPTool propagates the error, which is fine, but the panic prevents that error path from being reached.

Suggested fix

Ensure that every code path inside doInstall (and any function it calls — lookupPackage, resolveVersion, Registry.Install, etc.) returns an error on HTTP/network failure instead of panicking. The singleflight wrapper recovers panics and repanics them, so any nil-pointer dereference or unchecked error inside the Do callback becomes a process-fatal crash.

Workaround

Set DOCKER_AGENT_AUTO_INSTALL=false in the environment to skip the auto-install path entirely.

Version

docker-agent v1.58.0