feat(ci): unified image repo with shared builder and tag-based variants

[chaodu-agent]

Summary

Consolidate all Docker images into a single repo (ghcr.io/openabdev/openab) with tag-based variants, and restructure the build to share a common builder layer.

Motivation

• Currently 14+ separate image repos (openab-claude, openab-codex, etc.)
• Each variant independently compiles the same Rust binary (~8 min each)
• Total build time: ~140 min for all variants
• Hard to manage and discover images across repos

Proposed Changes

1. Single Image Repo + Tag Strategy

All images push to ghcr.io/openabdev/openab, differentiated by tag:

ghcr.io/openabdev/openab:<version>-<agent>
ghcr.io/openabdev/openab:<version>          ← default (kiro-unified)
ghcr.io/openabdev/openab:latest

Agents: kiro, claude, codex, copilot, cursor, gemini, grok, hermes, mimocode, opencode, antigravity, pi, native, agentcore

2. Shared Builder Layer

[Job 1] build-core (1× compile, 2 arch)  ~8-10 min
    → openab binary (unified mode, superset)

[Job 2] build-agents (14× parallel, 2 arch)  ~2 min each
    → COPY --from=core + install agent CLI only

[Job 3] merge-manifests (14× parallel)  ~1 min
    → multi-arch manifest per variant

Result: ~12 min total (vs ~140 min today)

3. Workflow Design

• workflow_dispatch with inputs: tag, branch, variants
• Default: build all variants from main
• Future: auto-trigger on version tag push

4. Dockerfile Restructure

• Dockerfile.builder — compiles openab binary (unified)
• Each agent Dockerfile becomes a thin layer:

  FROM ghcr.io/openabdev/openab:builder-<sha> AS core
  FROM debian:bookworm-slim
  COPY --from=core /usr/local/bin/openab /usr/local/bin/
  RUN <install agent CLI>

5. Helm Chart Update

Image reference changes from:

image: ghcr.io/openabdev/openab-claude:latest

to:

image: ghcr.io/openabdev/openab:v0.9.0-claude

Tasks

• Restructure Dockerfiles (builder base + agent layers)
• Create new build-images.yml workflow (dispatch, matrix, shared builder)
• Update Helm chart image reference template
• Update snapshot-build.yml or deprecate in favor of new workflow
• Test full matrix build
• Update docs

Notes

• unified mode becomes the only build mode (superset of default)
• Non-unified images deprecated — unified handles Discord + Slack + Gateway all-in-one
• Multi-arch (amd64 + arm64) for all variants

cc @pahudnet