v2.2.1 — Dockerfile font fixes (unblocks v2.2.0 customer rollout)

Patch — unblocks v2.2.0 customer rollout

v2.2.0's image never built: a font added in PR #166 — fonts-crimson-pro — does not exist in Ubuntu 24.04 noble. Every BuildKit run failed at the apt-install layer:

E: Unable to locate package fonts-crimson-pro
exit code: 100

No atlas:v2.2.0 ever landed in the registry, so customer pods stayed on v2.1.0.

Fix (PR #178)

• Drop fonts-crimson-pro from apt.
• New scripts/install-google-fonts.sh — data-driven (one FONTS array entry per .ttf) — downloads a curated set of Google Fonts as variable .ttf files into /usr/share/fonts/google/ and runs fc-cache -f.
• Own Docker layer so font changes don't bust the ~2 GB apt+npm+bun+chrome layer.
• Robust: curl --retry 3 --max-time 60 -f, TTF magic-byte check rejects HTML error pages, idempotent on re-run, uses od (no xxd dep).

Fonts shipped (17 families)

apt (unchanged + Ubuntu) — Inter, IBM Plex (Sans / Serif / Mono), JetBrains Mono, Noto + Noto CJK, Ubuntu (new), Liberation, DejaVu.

Google Fonts download (new) — Crimson Pro, Lora, Merriweather, EB Garamond, Playfair Display, Source Serif 4, Roboto, Roboto Flex, Manrope, Work Sans, Raleway, Geist, Fira Sans, Fira Mono, Fira Code, Anton, Lobster.

"Google Sans" is not in github.com/google/fonts (it's a closed product font). Roboto Flex is Google's own open replacement and ships here instead.

Adding a font is one line in the FONTS array — no Dockerfile churn.

Verified

End-to-end locally: 28 .ttf URLs return 302, all files retrieve cleanly with valid TTF magic, fc-query reads expected family names. The image build itself needs CI (no docker-in-docker in dev container).

Rollout

1. CI builds atlas:v2.2.1
2. Flux ImageUpdateAutomation commits new digest to the customer manifest (5 min)
3. Manually delete each customer pod for OnDelete rolling restart