feat(images): add developer image bakes

[vincentkoc]

Summary

• add Linux developer-image prep with Node 24, pnpm, GitHub CLI, desktop/browser helpers, Docker Engine, Compose, buildx, and cached base Docker images
• add Windows developer-image prep with Chocolatey tooling, Node 24, pnpm, and headless Windows Server Docker Engine support
• add a guarded AWS developer-image mint wrapper that defaults to a no-spend plan, proves source/candidate/promoted AMIs, records warmup timing logs, cleans up failed warmup leases, and handles Windows reboot/settle behavior before AMI capture
• tighten the macOS developer-tools image wrapper so the default dev image contract is macOS 15+, Swift tools 6.2+, full Xcode.app, and a newer EC2 Mac host family, while leaving CLT-only bakes explicit
• document Linux/Windows/macOS developer-image bakes, Docker expectations, full-Xcode macOS requirements, and fast-boot tradeoffs for AWS AMIs and Fast Snapshot Restore

Verification

• bash -n scripts/install-macos-developer-tools.sh scripts/mint-macos-devtools-image.sh scripts/macos-image-lifecycle-smoke.sh scripts/install-linux-developer-tools.sh scripts/mint-aws-devtools-image.sh
• shellcheck scripts/install-macos-developer-tools.sh scripts/mint-macos-devtools-image.sh scripts/macos-image-lifecycle-smoke.sh scripts/install-linux-developer-tools.sh scripts/mint-aws-devtools-image.sh
• node --test scripts/mint-macos-devtools-image.test.js scripts/macos-image-lifecycle-smoke.test.js scripts/mint-aws-devtools-image.test.js
• go test ./internal/cli
• go build -trimpath -o bin/crabbox ./cmd/crabbox
• git diff --check
• GitHub checks: Go, Worker, Docs, Release Check, CodeQL, Socket, and Analyze jobs all passing on 9624a95aac861f6c3a73ffe83a7f59ccc1677959

Live image proof

• Linux candidate bake passed in eu-west-1:
  • source lease: cbx_b308cea5ed2c / silver-barnacle
  • candidate AMI: ami-0f0239a3397d28259
  • candidate lease: cbx_f480eff8d093 / crimson-hermit
  • candidate warmup: 76.155s
  • smoke run: run_154595fab130
  • verified: Git, GitHub CLI, jq, ripgrep, fd, Python, Node 24.15.0, npm, corepack, pnpm 11.1.0, Docker 29.5.0, Docker Compose 5.1.3, and prebaked hello-world, ubuntu:24.04, node:24-bookworm images
• Windows candidate bake passed in us-west-2:
  • source lease: cbx_804e2eb8ef50 / violet-hermit
  • source smoke run: run_989bb2cf0864
  • candidate AMI: ami-07a874a66c4393f58
  • candidate lease: cbx_5457cdd04481 / brisk-hermit
  • candidate warmup: 254.946s
  • readiness probe run: run_346eb4b67ca5
  • candidate smoke run: run_18e6f79f665b
  • verified: Windows Server 2022, Git, GitHub CLI, jq, ripgrep, fd, Python 3.13.13, Node 24.11.1, npm 11.6.2, corepack, pnpm 11.1.3, Docker 29.5.1 daemon, and prebaked mcr.microsoft.com/windows/servercore:ltsc2022

Notes

• The AWS mint wrapper is dry-run by default; --run is required before it creates leases or AMIs.
• Linux and Windows proof bakes were run with --no-promote; image promotion remains an explicit operator step.
• macOS full app proof still needs a newly baked full-Xcode image; the previous host had Command Line Tools only, macOS 14.8.5, Swift 6.0.3, and no usable xcodebuild, which is not enough for Swift tools 6.2 / macOS 15 SDK lanes.

[vincentkoc]

Post-merge deploy/promote proof:

• merged no-squash via merge commit d404cdc1e69229b310f3016c69a7184fb0cfa7c4
• local binary minted from merged tree: go build -trimpath -o bin/crabbox ./cmd/crabbox
• Worker deployed with npm run deploy --prefix worker
  • Cloudflare Worker version: ad28303b-b706-46ac-b4d6-d0144c0aad45
• promoted Linux developer AMI:
  • ami-0f0239a3397d28259 in eu-west-1
  • promoted at 2026-05-19T19:26:36.729Z
  • promoted warmup lease: cbx_8955bbba4469 / tidal-barnacle, 42.304s
  • smoke run: run_bc4688d0996a
  • verified Node, pnpm, Docker, Compose, and cached hello-world, ubuntu:24.04, node:24-bookworm
• promoted Windows developer AMI:
  • ami-07a874a66c4393f58 in us-west-2
  • promoted at 2026-05-19T19:26:37.412Z
  • promoted warmup retried once after an SSH auth timeout, then succeeded with lease cbx_6866bacfaf54 / violet-prawn
  • smoke run: run_9fdfde000a28
  • verified Node, pnpm, Docker daemon, and cached mcr.microsoft.com/windows/servercore:ltsc2022
• cleanup: no active leases remain for vincentkoc@ieee.org