ci: refactor Dockerfiles to support PREBUILT_BINARY arg for CI optimization

[thepagent]

Context

PR #982 optimized the Docker Smoke Test by building openab once and injecting it into each agent image. The current implementation uses sed/awk to rewrite Dockerfiles at CI time, which is fragile — it broke on Dockerfile.antigravity (multi-stage with adapter-builder) and required multiple follow-up fixes.

Proposal

Add a PREBUILT_BINARY build arg to each Dockerfile. When set, skip the Rust build and use the provided binary:

# --- Build stage ---
FROM rust:1-bookworm AS builder
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo 'fn main() {}' > src/main.rs && cargo build --release && rm -rf src
COPY src/ src/
RUN touch src/main.rs && cargo build --release

# --- Runtime stage ---
FROM debian:bookworm-slim
ARG PREBUILT_BINARY=
COPY ${PREBUILT_BINARY:+$PREBUILT_BINARY} ${PREBUILT_BINARY:-/doesnotexist} /tmp/_maybe
COPY --from=builder /build/target/release/openab /usr/local/bin/openab
# Or simpler: just use a conditional RUN with a multi-stage copy

Or even simpler — a two-line approach per Dockerfile:

ARG OPENAB_BIN=
FROM rust:1-bookworm AS builder
# ... existing build ...

FROM debian:bookworm-slim
ARG OPENAB_BIN
COPY --from=builder /build/target/release/openab /usr/local/bin/openab
RUN if [ -n "$OPENAB_BIN" ]; then cp /tmp/openab /usr/local/bin/openab; fi

Scope

• 12 Dockerfiles to modify (all sharing the same builder pattern)
• Workflow update: docker build --build-arg PREBUILT_BINARY=.pre-built/openab
• Remove the sed/awk Dockerfile rewriting logic from docker-smoke-test.yml

Benefits

• No fragile string manipulation in CI
• Dockerfiles remain self-contained and buildable standalone
• Multi-stage builds (antigravity, future adapters) work without special handling

Related: #981, #982, #983

[github-actions]

Thanks for the report! A maintainer will triage this shortly and apply the appropriate label. Once a type label is added, the issue will be re-validated automatically.