attemp to develop rig in spr without an actual use case

rig/ctrl/Dockerfile.deps

@@ -0,0 +1,46 @@
+# The toolchain installer image. It does NOT run the cluster — it installs a toolchain
+# onto the host and gets out of the way.
+#
+# This exists to kill a bootstrap paradox: a plain bash installer needs curl, jq
+# and sha256sum to already be present, and a minimal Debian has none of them.
+# It carries its own toolchain, so the only host prerequisite is Docker.
+#
+# Two variants from one file:
+#   docker build -f ctrl/Dockerfile.deps --target deps        -t <slug>-deps        .
+#   docker build -f ctrl/Dockerfile.deps --target deps-full -t <slug>-deps:full   .
+#
+# deps-full bakes every pinned binary in at build time. `docker save` it and
+# you have the whole installer as one file to carry into an air-gapped network.
+
+FROM debian:trixie-slim AS deps
+
+# ca-certificates + curl: fetch and verify. graphviz + python3: render diagrams
+# and validate the arch model, so the host never needs an apt package.
+#
+# docker-cli, NOT docker.io: we only ever talk to the host's daemon through the
+# mounted socket, and under --no-install-recommends the docker.io package ships
+# docker-init without the actual `docker` binary.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl jq graphviz python3 docker-cli \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /work
+COPY ctrl/versions.env /work/ctrl/versions.env
+COPY ctrl/deps.sh    /work/ctrl/deps.sh
+RUN chmod +x /work/ctrl/deps.sh
+
+# Defaults; every one is overridable with -e at run time.
+ENV DEPS_SOURCE=upstream \
+    OUT_BIN=/out/bin \
+    HOST_ROOT=/host
+
+ENTRYPOINT ["/work/ctrl/deps.sh"]
+CMD ["install"]
+
+
+# ---------------------------------------------------------------------------
+# deps-full — same image, binaries baked in, works with no network at all.
+FROM deps AS deps-full
+RUN /work/ctrl/deps.sh fetch --to /opt/rig/bin
+ENV DEPS_SOURCE=baked \
+    BAKED_BIN=/opt/rig/bin