Bring build-agent and route-proxy in whole (issue 1019)

modules/build-agent/Dockerfile

@@ -0,0 +1,25 @@
+ARG GO_BASE
+ARG ALPINE_BASE
+# build-agent's image: the build machine itself, compiled into a container (novox/hq ADR 0190).
+#
+# **The source sits beside this module.** The program, cmd/mesh-builder with internal/builder and
+# internal/catalogue, lives in this same repository, mesh-controller, which is also the build context
+# (declared under build.artifacts[].context; a module lives whole in one repository, novox/hq ADR 0420),
+# so this Dockerfile compiles ./cmd/mesh-builder from the repository root. The build seat hands it only
+# that program's build source (novox/hq ADR 0267, the artifact's `compiles`): a merge elsewhere in the
+# repository does not move this image.
+FROM ${GO_BASE} AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false -ldflags=-buildid= -o /mesh-builder ./cmd/mesh-builder
+
+# Unlike mesh-controller's own FROM scratch (ADR 0006: nothing to audit but one binary), the build
+# machine's whole job is shelling out to git and docker — it needs a real userland to do that in,
+# not a second copy of either tool vendored into this image. apk installs both from the base's own
+# packages, not fetched on its own at build time.
+FROM ${ALPINE_BASE}
+RUN apk add --no-cache docker-cli git
+COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
+ENTRYPOINT ["/usr/local/bin/mesh-builder"]