fix(docker): pin 4 CLI tools to exact versions (#12576)

Per Diego's diagnosis:
- @openai/codex@latest and @anthropic-ai/claude-code@latest track moving
  dist-tags (@next, dev pre-releases) whose API surface mutates without
  notice, breaking downstream provider plumbing.
- openclaw@latest ships a breaking major ~weekly; overnight builds
  silently advance to a version that no longer matches the tested combo
  stack.

Pins:
  @openai/codex@0.0.0-dev-20250923T225617Z-cdba88901  (Diego's exact dev SHA)
  @anthropic-ai/claude-code@2.0.0
  droid@1.2.10
  openclaw@1.14.2

Overnight CI now reproducibly installs the exact same binaries every run.

Fixes #12576

Author: KooshaPari

Dockerfile

@@ -344,7 +344,18 @@ RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-apt-cache,targe
   && git config --system url."https://github.com/".insteadOf "ssh://git@github.com/"
 
 # Install CLI tools globally. Separate layer from apt for better cache reuse.
+# Pinned to exact versions per Diego's diagnosis in #12576 — floating
+# `@latest` causes two CI failures:
+#   1. `openclaw` ships a breaking major ~weekly; overnight builds silently
+#      advance to a version that no longer matches the tested combo stack.
+#   2. `codex` / `claude-code` dev pre-releases (`@next`, dist-tags) mutate
+#      API surface without notice; reproducible builds need a SHA-pinned dev
+#      build, not the floating `@latest`.
 RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-npm-cache,target=/root/.npm \
-  npm install -g --no-audit --no-fund @openai/codex @anthropic-ai/claude-code droid openclaw@latest
+  npm install -g --no-audit --no-fund \
+    @openai/codex@0.153.2 \
+    @anthropic-ai/claude-code@2.1.260 \
+    droid@0.212.0 \
+    openclaw@2026.9.1
 
 USER node