rig updates

rig/ctrl/Dockerfile.deps

@@ -24,23 +24,27 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates curl jq graphviz python3 docker-cli \
     && rm -rf /var/lib/apt/lists/*
 
+# The installer is the generated standalone kit, not deps.sh plus the files it
+# reads. A kit is one file with its pins frozen in and is proven to run with
+# nothing else from rig present — which is exactly what an image needs, and
+# `make standalone` keeps it current. Pins are the same in every profile's kit.
+ARG PROFILE=minimal
 WORKDIR /work
-COPY ctrl/versions.env /work/ctrl/versions.env
-COPY ctrl/deps.sh    /work/ctrl/deps.sh
-RUN chmod +x /work/ctrl/deps.sh
+COPY standalone/${PROFILE}/rigdeps.sh /work/rigdeps.sh
+RUN chmod +x /work/rigdeps.sh
 
 # Defaults; every one is overridable with -e at run time.
 ENV DEPS_SOURCE=upstream \
     OUT_BIN=/out/bin \
     HOST_ROOT=/host
 
-ENTRYPOINT ["/work/ctrl/deps.sh"]
+ENTRYPOINT ["/work/rigdeps.sh"]
 CMD ["install"]
 
 
 # ---------------------------------------------------------------------------
 # deps-full — same image, binaries baked in, works with no network at all.
 FROM deps AS deps-full
-RUN /work/ctrl/deps.sh fetch --to /opt/rig/bin
+RUN /work/rigdeps.sh fetch --to /opt/rig/bin
 ENV DEPS_SOURCE=baked \
     BAKED_BIN=/opt/rig/bin