feat(docker): bake herdr + tmux into webtop image

[gitricko]

What Changed

• Added a pinned, SHA-256-verified installation of the herdr session backend (v0.7.4, protocol-16 family) into the Docker image via a new build script (docker/scripts/fm-install-herdr.sh) that downloads the official GitHub release asset bounded by max size and verifies version/protocol gates after install.
• Added tmux and jq to the apt-installed utilities in the Dockerfile; tmux serves as the fallback session backend and jq parses herdr's JSON status protocol.
• Introduced a HERDR_VERSION build ARG that the Docker build enforces against the installed binary version after running the install script.

Risk Assessment

✅ Low: Well-bounded Docker/build change that bakes a pinned, SHA-256-verified herdr binary plus tmux/jq into the image with version/protocol gates and correct multi-arch handling, presenting little ambiguity or risk.

Testing

Exercised the new herdr install step on Linux/aarch64: the fm-install-herdr.sh script the Dockerfile runs completed end-to-end (pinned 0.7.4 asset downloaded, SHA-256 verified, installed, version 0.7.4 and protocol 16 gates passed), and herdr --version reports 0.7.4 matching the Dockerfile bump guard. A tampered-checksum run proved the SHA gate fails closed (exit 1). I could not build the full container image because the docker daemon is inaccessible in this sandbox, so in-image confirmation of the tmux/jq apt addition and /usr/local/bin placement is left to the remote docker-publish CI build.

Evidence: herdr installer positive run (transcript)

fm-install-herdr.sh: downloading herdr-linux-aarch64 from https://github.com/ogulcancelik/herdr/releases/download/v0.7.4/herdr-linux-aarch64
fm-install-herdr.sh: installed herdr 0.7.4 (protocol 16) to /tmp/herdr-test-bin/herdr herdr 0.7.4

fm-install-herdr.sh: downloading herdr-linux-aarch64 from https://github.com/ogulcancelik/herdr/releases/download/v0.7.4/herdr-linux-aarch64
fm-install-herdr.sh: installed herdr 0.7.4 (protocol 16) to /tmp/herdr-test-bin/herdr
herdr 0.7.4

Evidence: version bump-guard + SHA gate evidence

Dockerfile ARG HERDR_VERSION=0.7.4; installed herdr --version = herdr 0.7.4 (matches); tampered-checksum installer exit = 1 (rejects mismatch)

=== Dockerfile ARG HERDR_VERSION line ===
ARG HERDR_VERSION=0.7.4
# HERDR_VERSION is a bump guard: it must match the pin inside scripts/fm-install-herdr.sh
ARG HERDR_VERSION
    test "$(/usr/local/bin/herdr --version | awk '{print $2; exit}')" = "${HERDR_VERSION}"; \
=== installed binary ===
-rwxr-xr-x 1 abc dialout 17438024 Aug 17 15:55 /tmp/herdr-test-bin/herdr
=== herdr --version (matches bump guard ARG) ===
herdr 0.7.4
=== negative SHA gate: tampered-script exit code ===
exit=1

- Outcome: ⚠️ 1 warning across 1 run (1m46s)

Pipeline

Updates from git push no-mistakes

⏭️ **intent** - skipped

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

⚠️ **Test** - 1 warning

• ⚠️ Could not complete the end-to-end 'baked into image' verification. The docker daemon is not accessible in this sandbox (docker info returns 'permission denied ... /var/run/docker.sock'), so the full webtop image could not be built to visually confirm tmux and jq are installed by the modified apt line and that the herdr binary lands at /usr/local/bin inside the container. The substantive new behavior (fm-install-herdr.sh) was proven directly on the host, but in-container confirmation of the apt step and PATH placement relies on the remote docker-publish CI build.
• bash docker/scripts/fm-install-herdr.sh /tmp/herdr-test-bin (positive path on Linux aarch64 — download, SHA verify, install, version+protocol gates) → exit 0, 'installed herdr 0.7.4 (protocol 16)'
• /tmp/herdr-test-bin/herdr --version → 'herdr 0.7.4', matching Dockerfile ARG HERDR_VERSION=0.7.4 bump guard
• /tmp/herdr-test-bin/herdr status --json → client protocol 16 (>= required floor 16)
• Negative SHA gate: copied script with aarch64 SHA256 set to 0000... → exit 1 with 'checksum mismatch'
• grep Dockerfile for ARG HERDR_VERSION=0.7.4 and installer pin FM_HERDR_CI_VERSION=0.7.4 to confirm bump-guard consistency

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.