STESOL-570 pin build inputs

[JoeStech]

This branch implements STESOL-570 by making the MCP image build reproducible and offline during installation.

Top-level changes:

• Pins Ubuntu, embeddings, Performix, migrate-ease, Python packages, and OS packages by version and digest/hash.
• Replaces the broad arm-linux-migration-tools installer with only the required tools.
• Creates verified AMD64 and Arm64 wheel and .deb bundles.
• Publishes those inputs as a private, multi-architecture GHCR artifact.
• Makes the final Dockerfile consume that artifact by immutable digest.
• Installs apt and Python dependencies without network access.
• Packages the embedding model, metadata, and index locally.
• Adds workflows, lock manifests, tests, and documentation for updating, publishing, inspecting, and consuming build inputs.

[Copilot]

Pull request overview

This PR implements STESOL-570 by making the mcp-local container build reproducible and offline at install time via a separately acquired, hash-verified build-input OCI artifact (plus a pinned embeddings/vectorstore artifact) that the final Docker build consumes strictly by immutable digests.

Changes:

• Introduces a lock manifest (mcp-local/build-inputs.lock.json) and an acquisition script/workflow to build and publish a multi-arch “build inputs” bundle (wheels, .deb closure, Performix, migrate-ease) to private GHCR.
• Refactors mcp-local/Dockerfile to install apt + Python dependencies with --network=none using only staged artifacts, and to consume pinned embeddings/model/index content by digest.
• Adds tests and documentation to enforce/describe immutability, offline constraints, and update/publish procedures.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the reproducible/offline input-bundle approach and updated local build guidance.
mcp-local/utils/config.py	Adds MODEL_PATH env wiring for local-only model loading.
mcp-local/server.py	Passes model_path into search resource initialization.
mcp-local/Dockerfile	Reworks the build to consume pinned GHCR input artifacts and install offline.
mcp-local/Dockerfile.inputs	Packages staged inputs into a scratch OCI artifact with a consistent layout.
mcp-local/scripts/stage-build-inputs.py	New acquisition/verifier for wheels, Ubuntu snapshot .deb closure, and pinned archives.
mcp-local/build-inputs.lock.json	New lock manifest capturing pinned images, package snapshots, and artifact hashes/digests.
mcp-local/pyproject.toml	Defines direct runtime dependency pins for uv-based lock generation.
mcp-local/requirements.txt	Converts to fully pinned direct runtime dependencies.
mcp-local/requirements.lock	Adds exported, hash-locked transitive requirements for offline pip installs.
mcp-local/tests/test_build_inputs.py	Adds enforcement tests for digest pinning, offline install patterns, and workflow constraints.
mcp-local/tests/test_apx_mounts.py	Adds unit tests for APX SSH mount auto-discovery and help-text behavior.
mcp-local/.dockerignore	Restricts build context for input-bundle publication to only required staged files/locks.
mcp-local/.gitignore	Ignores staged build-input directories and __pycache__.
mcp-local/.python-version	Pins local Python version used for lock/tooling workflows.
.github/workflows/build-mcp-inputs.yml	New manual workflow to acquire/verify/publish multi-arch build-input bundles to GHCR.
.github/workflows/build-mcp-image.yml	Updates image build workflow to log in to GHCR and consume pinned inputs (no live acquisition).
.github/workflows/integration-tests.yml	Adds GHCR auth and includes new build-input invariants test in unit test set.
.dockerignore	Restricts the repo-root Docker build context to only what mcp-local/Dockerfile needs.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[brikin01]

We're coming along nicely, this was a big chunk and great improvement to the build flow! My main concern is that the MCP build still triggers immediately after embedding generation while consuming the previously pinned embedding digest, so we should clarify the promotion and release flow. I also left a few smaller comments and questions.

[brikin01]

Really like the human-in-the-loop promotion flow! I think after missing script is added and the merge conflicts with #136 are resolved, it should be g2g.

[brikin01]

LGTM! I saw your comment on migrate-ease, not sure if you wanted to add to this PR or just add as a follow-up, either makes sense to me