fix(docker): replace BuildKit-only COPY flags with universal COPY + RUN chmod

[liuhao1024]

What does this PR do?

Replaces the BuildKit-only COPY --link --chmod=a+rX,go-w instruction with a universally compatible COPY . . followed by RUN chmod -R a+rX,go-w .. The --link flag and symbolic --chmod format are Docker BuildKit extensions that break Podman/Buildah builds, preventing users on Fedora/RHEL/rootless Linux from building the image at all.

Related Issue

Fixes #62849

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• Dockerfile line 202: replaced COPY --link --chmod=a+rX,go-w . . with COPY . . + RUN chmod -R a+rX,go-w .
• Dockerfile lines 196-201: updated comment to explain the engine-compatibility rationale
• tests/tools/test_dockerfile_immutable_install.py: updated assertions to match the new COPY + RUN chmod pattern; added assertion that COPY --link is absent

How to Test

1. python -m pytest tests/tools/test_dockerfile_immutable_install.py tests/tools/test_dockerfile_node_modules_perms.py -v — should pass (7/7 tests green)
2. Build with Docker: docker build -f Dockerfile . — should succeed (COPY + RUN chmod produces identical permissions)
3. Build with Podman: podman build -f Dockerfile . — should now succeed (previously failed with Error parsing chmod a+rX,go-w)

Observed result: All 7 contract tests pass on macOS. The permissions produced by RUN chmod -R a+rX,go-w . are identical to those previously baked by COPY --chmod=a+rX,go-w.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.4.1

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[teknium1]

Thanks for documenting the Podman report. The underlying failure is still present on current main at Dockerfile:202, but the proposed workaround is not valid.

Problems

• Dockerfile:205 says podman build --build-arg DOCKER_BUILDKIT=1 should work. Podman's --build-arg only interpolates an argument into Containerfile instructions; it does not select BuildKit. Current Dockerfile:202 is a literal COPY --link --chmod=a+rX,go-w . . and has no ARG DOCKER_BUILDKIT, so that command cannot alter the failing instruction.
• A comment alone does not make the native podman build path requested in #62849 succeed; the issue additionally identifies --link as a Buildah incompatibility.

Suggested changes

• Remove the --build-arg DOCKER_BUILDKIT=1 workaround and replace it only with a verified path, or implement a compatible build path while retaining the immutable-install contract covered by tests/tools/test_dockerfile_immutable_install.py:15-24.

Automated hermes-sweeper review.

[teknium1]

--build-arg only supplies a value for interpolation in Containerfile instructions; it does not enable BuildKit. This Dockerfile has no ARG DOCKER_BUILDKIT and line 202 is a literal COPY instruction, so this command cannot make Podman accept the unsupported flags. Please remove or replace this with a verified workaround.