Build-once RC publish: immutable php83/84/85 + bare + :testing (Plan 1)

[jsokol]

Summary

Plan 1 of the build-once-promote container-pipeline redesign. Makes the testing-branch publish the single build-once producer of the immutable simplerisk-minimal image set, so the RC built from the testing bundle is later promoted (retagged) to prod rather than rebuilt.

Design + plan (code-development docs/superpowers/):
specs/2026-07-10-release-image-promotion-design.md, plans/2026-07-10-docker-publish-pipeline-buildonce.md.

What changed (5 commits)

• generate_dockerfile.sh — decoupled the image version from the app-source mode: new signature generate_dockerfile.sh <version> [context|download]. The RC image now self-reports its real ENV version (not the literal testing). Default PHP → 8.5.
• generate_dockerfile.sh — folded in the PREGA_BUNDLE_FALLBACK download-recipe fallback (prod bundle first → bundles-test pre-GA → hard-fail), superseding ci(container-validation): fall back to testing bundle/SQL when prod artifacts absent (pre-GA) #146 (which can be closed).
• container-validation.yml — added a PHP 8.5 validation job and fixed the minimal job-key/PHP naming skew (php84 built 8.3, etc.).
• publish-testing.yml — builds php 8.3/8.4/8.5 from the testing bundle and publishes <V>-php83/84/85 + bare <V> + floating testing (bare + testing ride only the php85 digest); drops <V>-testing; sets the testing SSM tier to <V>-php85. Timeout raised to 120m for the three sequential multi-arch builds.
• committed Dockerfile regenerated to match the generator; test_generate_dockerfile.sh added (non-destructive checker); CLAUDE.md php refs updated.

Validation

• test_generate_dockerfile.sh (context/download modes, real ENV version, php-8.5 default, invalid-mode rejection, idempotence) — green.
• actionlint (publish-testing, container-validation) — clean. shellcheck (both scripts) — clean.
• Reviewed task-by-task + a whole-branch review; all findings resolved.

Notes

• container-validation.yml only runs on PRs to master, so image-build validation for this change happens post-merge when publish-testing.yml builds the real RC (and at the eventual testing → master PR). This PR is the code-review gate.
• The bare <V> / :latest / prod-SSM promotion is Plan 2 (a separate manual promote-latest dispatch); this PR does not touch prod.

🤖 Generated with Claude Code