The git-push gate (handler.hooks.gate -> verify.run_build) shells
`mise run build-image`, but .mise.toml never defined that task, so every agent
push was hard-blocked with "no task build-image found". Define it.
The agent sandbox and control image ship no container daemon or builder (by
design — no Docker socket, no --privileged), so a real image build can't run at
push time. Use hadolint as a daemonless soundness check on both Dockerfiles,
with .hadolint.yaml pinning the failure threshold to errors so genuine
Dockerfile mistakes block the push while the deliberate, commented style
choices (unpinned apt/npm/go) don't. The authoritative end-to-end multi-arch
build-and-push stays in CI (.github/workflows/docker*.yml) on every PR to main.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tester