v0.41.2: BB-06 install libra from libra.tools in interop-smoke

Add the final stage of Dockerfile.interop-smoke (plan-20261001 BB-06):
the official libra.tools installer with LIBRA_REQUIRE_CHECKSUM=1 (signed
stable manifest + sha256), latest stable by default with optional
LIBRA_VERSION pin and LIBRA_CACHE_BUST, and the installed version recorded
in /etc/interop-smoke/libra-version. Also marks BB-01 done/complete after
its docker job succeeded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bJDjze83ToyPysYzmxxWS
Signed-off-by: Eli Ma <eli@patch.sh>

Author: genedna

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mega2"
-version = "0.41.1"
+version = "0.41.2"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 description = "Monorepo engine and Git hosting server for AI agents: trunk-based storage, Git Smart HTTP, Git LFS, OCI registry, and Agent Session Capture"

Cargo.toml

@@ -87,3 +87,25 @@ RUN chmod 0755 /usr/local/bin/interop-smoke-selfcheck \
 # Default: stay up for `docker compose exec`. A plain `docker run IMAGE CMD`
 # overrides this (used by the verification commands).
 CMD ["sleep", "infinity"]
+
+# Final stage (BB-06): the official libra client from libra.tools. The
+# installer verifies its Ed25519-signed stable manifest and the binary's
+# sha256 (LIBRA_REQUIRE_CHECKSUM=1); fallback installs are never enabled.
+# LIBRA_VERSION empty = latest stable; LIBRA_CACHE_BUST forces a fresh layer
+# so a rebuild picks up a newer stable release.
+FROM base AS final
+
+ARG LIBRA_VERSION=""
+ARG LIBRA_CACHE_BUST=""
+
+RUN set -eu; \
+    echo "libra cache bust: ${LIBRA_CACHE_BUST:-none}"; \
+    curl --proto '=https' --tlsv1.2 -sSf https://download.libra.tools/install.sh -o /tmp/libra-install.sh; \
+    sha256sum /tmp/libra-install.sh; \
+    LIBRA_REQUIRE_CHECKSUM=1 LIBRA_NO_TUI=1 LIBRA_HOME=/tmp/libra-home \
+        sh /tmp/libra-install.sh -d /usr/local/bin --no-modify-path --no-alias ${LIBRA_VERSION:+-v "$LIBRA_VERSION"}; \
+    rm -rf /tmp/libra-install.sh /tmp/libra-home; \
+    mkdir -p /etc/interop-smoke; \
+    libra --version > /etc/interop-smoke/libra-version; \
+    test -s /etc/interop-smoke/libra-version; \
+    cat /etc/interop-smoke/libra-version

Dockerfile.interop-smoke

@@ -514,7 +514,7 @@
 ### Task BB-01: interop-smoke 基础镜像
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.1；Codex R3 PASS；C 组：2023 测试通过；待 D 组 `docker` job）  
+**Lifecycle / Acceptance:** `done` / `complete`（v0.41.1 / `573d322`；Codex R3 PASS；C 组 2023 测试通过；D 组 docker run 36889926666 success）  
 **Description:** 新建 `Dockerfile.interop-smoke` 的基础部分（ADR-BB-02）：digest 固定的 `debian:trixie-slim` + `bash ca-certificates curl git jq openssh-client openssl ripgrep shellcheck socat` + git-lfs 3.8.0 与 oras（版本与 sha256 均以 `ARG` 固定，`sha256sum -c` 校验，不符即构建失败）+ 镜像内自检脚本 `/usr/local/bin/interop-smoke-selfcheck`（逐个检查上述工具可执行，任一缺失非 0 退出）。唯一行为轴：runner 基础工具链。  
 **Out of scope:** libra 安装（BB-06）；compose 服务与环回中继（BB-04）；改 `Dockerfile.git-smoke`（GC-BB-06，永久非目标）。  
 **Current evidence:**
@@ -567,7 +567,7 @@
 ### Task BB-06: interop-smoke 安装 libra 最新 stable
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `pending` / （空）  
+**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.2；Codex R1 PASS；C 组 2023 测试通过（ER-10 两次重试：端口 / 连接抖动，停 trunk 栈后全绿）；待 D 组 `docker` job）  
 **Description:** 在 `Dockerfile.interop-smoke` 的最终阶段（基于 BB-01 的 `base`）按 ADR-BB-02 §3 用 libra.tools 官方安装器安装最新 stable libra（`LIBRA_REQUIRE_CHECKSUM=1`，禁用 fallback），并把 `libra --version` 写入 `/etc/interop-smoke/libra-version`。唯一行为轴：runner 中的 libra 客户端。  
 **Out of scope:** 基础工具链（BB-01）；libra 版本下限检查（BB-50 前置检查）。  
 **Current evidence:**