fix(OMN-13946): add libatomic1 to runner image (Pyright node runtime defect)

docker/runners/Dockerfile

@@ -55,13 +55,18 @@ ENV OMNI_RUNNER_IMAGE_VERSION=${OMNI_RUNNER_IMAGE_VERSION}
 ENV OMNI_CI_ENV_ROOT=${OMNI_CI_ENV_ROOT}
 
 # Install system dependencies
+# libatomic1 (OMN-13946): the GitHub Actions bundled node runtime (used by
+# node-based actions, e.g. pyright) dlopens libatomic.so.1 at load time.
+# Ubuntu 22.04 does not pull it in transitively; without it every node-based
+# action fails with "node: libatomic.so.1: cannot open shared object file".
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
     git \
     jq \
     tar \
     unzip \
+    libatomic1 \
     libicu-dev \
     libkrb5-3 \
     zlib1g \

docker/runners/runner-image.lock.json

@@ -1,8 +1,8 @@
 {
   "base_image_digest": "sha256:3ba65aa20f86a0fad9df2b2c259c613df006b2e6d0bfcc8a146afb8c525a9751",
   "gh_version": "2.67.0",
-  "identity_digest": "e0748bfb2601b0a607fa9b105bae3fa0",
-  "image_version": 5,
+  "identity_digest": "5426a8f631cb029a452dbfaf124a0971",
+  "image_version": 6,
   "kubectl_version": "1.32.1",
   "python_version": "3.12",
   "runner_version": "2.334.0",

src/omnibase_infra/cli/cli_skill.py

@@ -232,13 +232,20 @@ def _write_payload(
     default=None,
     help="Unix socket of the emit daemon (default: ~/.claude/emit.sock).",
 )
+@click.option(
+    "--omni-home",
+    type=click.Path(path_type=Path),
+    default=None,
+    help="Canonical omni_home workspace root for the local omnimarket drift check.",
+)
 @click.argument("skill_args", nargs=-1, type=click.UNPROCESSED)
 def run_skill_by_name(
     skill_name: str,
     state_root: Path,
     timeout: int | None,
     verbose: bool,
     emit_socket: Path | None,
+    omni_home: Path | None,
     skill_args: tuple[str, ...],
 ) -> None:
     """Dispatch a skill to its backing node and print one typed result.
@@ -257,7 +264,7 @@ def run_skill_by_name(
         onex skill delegate "summarize this paragraph" --task-type document
     """
     try:
-        check_omnimarket_drift()
+        check_omnimarket_drift(omni_home=str(omni_home) if omni_home else None)
     except OmnimarketDriftError as exc:
         raise click.ClickException(str(exc)) from exc
 

src/omnibase_infra/cli/omnimarket_drift_guard.py

@@ -38,7 +38,6 @@
 
 import json
 import logging
-import os
 import subprocess
 from importlib.metadata import PackageNotFoundError, distribution
 from pathlib import Path
@@ -94,12 +93,9 @@ def canonical_local_omnimarket_commit(omni_home: str | None = None) -> str | Non
     ``pull-all.sh`` / the repair tick (OMN-14060), not every skill dispatch;
     this function only reads whatever is already checked out.
     """
-    resolved_home = (
-        omni_home if omni_home is not None else os.environ.get("OMNI_HOME", "")
-    )
-    if not resolved_home:
+    if not omni_home:
         return None
-    omnimarket_root = Path(resolved_home) / "omnimarket"
+    omnimarket_root = Path(omni_home) / "omnimarket"
     if not (omnimarket_root / ".git").exists():
         return None
     try:
@@ -116,7 +112,7 @@ def canonical_local_omnimarket_commit(omni_home: str | None = None) -> str | Non
     return sha if len(sha) == 40 else None
 
 
-def check_omnimarket_drift() -> None:
+def check_omnimarket_drift(omni_home: str | None = None) -> None:
     """Fail fast if the current venv's omnimarket has drifted from the
     canonical local clone.
 
@@ -130,7 +126,7 @@ def check_omnimarket_drift() -> None:
     installed = installed_omnimarket_commit()
     if installed is None:
         return
-    canonical = canonical_local_omnimarket_commit()
+    canonical = canonical_local_omnimarket_commit(omni_home=omni_home)
     if canonical is None:
         return
     if installed != canonical:

tests/integration/infra/test_omn_12765_release_backmerge_identity.py

@@ -49,8 +49,9 @@ def test_release_backmerge_preserves_runner_identity_lock() -> None:
         (ROOT / "docker/runners/runner-image.lock.json").read_text(encoding="utf-8")
     )
 
-    # OMN-13942 / OMN-141xx: identity regenerated after dependency-manifest
-    # changes. The identity binds the full manifest bytes (binding-not-label),
-    # so dependency-range updates rebind the runner lock.
-    assert lock["identity_digest"] == "e0748bfb2601b0a607fa9b105bae3fa0"
+    # OMN-13946: image_version bumped 5->6 to add the missing libatomic1
+    # package (node-based actions dlopen libatomic.so.1 at load time). The
+    # regenerated identity binds image_version=6 plus the current dev shared
+    # environment digest, not either predecessor's digest in isolation.
+    assert lock["identity_digest"] == "5426a8f631cb029a452dbfaf124a0971"
     assert lock["shared_env_digest"] == "b70e24f5e8a8b820ed017a61"