cfebdf5cd4
build-golden.sh: same-path /opt/docker/stacks host bind (Section-G fix, breaks all bind-mounted stacks without it) + --hostname <customer-id> from bootstrap.json (portable sed parse, no jq) + bake the 3 pinned public base-infra images with a manifest-inspect hard gate. Provision --selftest defaults -hostname to the DNS-safe-sanitized customer-id so the CT/LXC is named meaningfully. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>