fix(hermes): require the resolved image lock digest

Require the caller-verified target lock checksum instead of an incompatible checked-in default. Document lock-bot ownership and the companion browser qualification PR.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docker/daytona-runner/Dockerfile

@@ -30,13 +30,14 @@ COPY packages ./packages
 COPY server/package.json ./server/package.json
 COPY ui/package.json ./ui/package.json
 COPY cli/package.json ./cli/package.json
-# The complete resolved lock (including transitive integrity hashes) is reviewed.
-# Reject registry-time drift BEFORE installing packages or running lifecycle code.
-# Refresh this digest together with source/provider dependency changes.
-ARG PAPERCLIP_RUNNER_LOCK_SHA256=f5ee14ee77b1dc7771fe455d619c880fc64b1e62e40a15704addc9f7430e5c50
+# The caller supplies the digest of its resolved, immutable target lockfile.
+# The repository lock bot owns committed lock updates; branch workflows resolve
+# and verify their target lock before copying it into this build context.
+ARG PAPERCLIP_RUNNER_LOCK_SHA256
 # pnpm 9 subtracts PNPM_WORKERS from available CPUs; it is not a worker count.
 # Subtract all available CPUs to select its minimum (one tarball worker).
 RUN export PNPM_WORKERS="$(node -p 'require("node:os").availableParallelism()')" \
+    && test "${#PAPERCLIP_RUNNER_LOCK_SHA256}" = 64 \
     && printf '%s  pnpm-lock.yaml\n' "${PAPERCLIP_RUNNER_LOCK_SHA256}" > /tmp/provider-lock.sha256 \
     && sha256sum -c /tmp/provider-lock.sha256 \
     && pnpm install --frozen-lockfile --filter '@paperclipai/paperclip-runner...'

docker/daytona-runner/README.md

@@ -57,11 +57,15 @@ The fleet image is currently amd64-only because the pinned Cursor and GitHub CLI
 checksums cover amd64.
 
 ```bash
+# Resolve the target manifest/patch changes without committing the bot-owned lock.
+pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
+lock_sha="$(shasum -a 256 pnpm-lock.yaml | cut -d ' ' -f 1)"
 content_id="$(pnpm --silent test:e2e:runner:image-id)"
 docker buildx build \
   --platform linux/amd64 \
   --build-arg PAPERCLIP_RUNNER_CONTENT_ID="${content_id}" \
   --build-arg PAPERCLIP_RUNNER_SOURCE_REVISION="$(git rev-parse HEAD)" \
+  --build-arg PAPERCLIP_RUNNER_LOCK_SHA256="${lock_sha}" \
   --tag "paperclip-daytona-runner:e2e-content-${content_id}" \
   --load \
   --file docker/daytona-runner/Dockerfile \