fix(docker): port build compatibility fixes

Author: linuxdevel

deploy/docker/Dockerfile.cli-macos

@@ -103,9 +103,10 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
+# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
 # invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
+ARG OPENSHELL_IMAGE_TAG
 RUN --mount=type=cache,id=cargo-registry-cli-macos,sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-cli-macos,sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-cli-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \

deploy/docker/Dockerfile.gateway

@@ -93,9 +93,11 @@ WORKDIR /app
 
 COPY --from=builder /build/openshell-server /usr/local/bin/
 
-# Copy migrations to the build-time manifest directory expected by sqlx
+# Copy migrations to the build-time manifest directory expected by sqlx.
+# Set stable world-readable permissions so restrictive host umasks do not make
+# migrations unreadable to the runtime `openshell` user.
 RUN mkdir -p /build/crates/openshell-server
-COPY crates/openshell-server/migrations /build/crates/openshell-server/migrations
+COPY --chmod=755 crates/openshell-server/migrations /build/crates/openshell-server/migrations
 
 USER openshell
 EXPOSE 8080

deploy/docker/Dockerfile.python-wheels

@@ -84,9 +84,10 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
+# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
 # invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
+ARG OPENSHELL_IMAGE_TAG
 RUN --mount=type=cache,id=cargo-registry-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-python-wheels-${TARGETARCH}-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \

deploy/docker/Dockerfile.python-wheels-macos

@@ -91,9 +91,10 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
+# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
 # invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
+ARG OPENSHELL_IMAGE_TAG
 RUN --mount=type=cache,id=cargo-registry-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-python-wheels-macos-${TARGETARCH}-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \