feat(devenv): de-pin 3 agent-image devenv-fork sites onto the tool (RIG-2812)

Route three executable hand-pins of the RigelBuild/devenv fork rev through
tools/toolchain/devenv-cli, resolving the flakeref from agent-image/devenv.lock
at runtime instead of a literal github:RigelBuild/devenv/<40hex>#devenv:

- tools/agent-image-env-gate/index.ts: direct core.ts import (devenvSource +
  flakeref), no CLI hop.
- agent-image/moon.yml: build task command: -> script: (resolve-then-run),
  runFromWorkspaceRoot so the tool/lock paths match ci.yml's seed step.
- devenv.nix dogfood:agent-image: ${config.devenv.root}-anchored tool call.

Behavior-preserving: the tool resolves the lock's devenv node to exactly the
removed literal (15a81f3e...). The fourth pin (agent-image/publish.sh) is
deferred to a stacked PR — it runs in release.yml's publish-image job, which
bootstraps no bun.

Part of RIG-2546 (T2a, RD-2 full-kill). Spec-impact: none.

Co-authored-by: Matt Wilkinson <matt@rigel.build>

Author: rigel-mintaka

agent-image/moon.yml

@@ -1,11 +1,12 @@
 # yaml-language-server: $schema=https://moonrepo.dev/schemas/project.json
 #
 # compass-agent-image (agent-image/): the compass-agent runtime image. A
-# standalone nix devenv, not a bun package — the build is
-# `nix run github:RigelBuild/devenv/15a81f3e15619187fcbe10c2eac40878e0b4ce28#devenv -- container build agent`, the same
-# fork-pinned derivation the publish lane ships (agent-image/publish.sh) and the
-# local `dogfood:agent-image` load produce. A green build here is proof the
-# exact artifact that publishes still builds.
+# standalone nix devenv, not a bun package — the build resolves the devenv fork
+# rev from agent-image/devenv.lock (via tools/toolchain/devenv-cli) and runs
+# `nix run "$src" -- container build agent`, the same derivation the publish lane
+# ships (agent-image/publish.sh) and the local `dogfood:agent-image` load
+# produce. A green build here is proof the exact artifact that publishes still
+# builds.
 #
 # WHY THIS IS A MOON PROJECT. Registering it in .moon/workspace.yml is what puts
 # the image build in the gate: on a PR `moon ci :ci` runs this project's `ci`
@@ -34,19 +35,26 @@ workspace:
 tasks:
   build:
     # Realise the image exactly as the publish lane and the dogfood load do —
-    # the same fork-pinned derivation, so a green build here proves the exact
-    # artifact that publishes builds. Runs from agent-image/ (moon's default
-    # project-dir cwd) so `devenv container build` resolves this image's
+    # the same derivation, so a green build here proves the exact artifact that
+    # publishes builds. The devenv fork rev is resolved from
+    # agent-image/devenv.lock at runtime (never hand-pinned) via
+    # tools/toolchain/devenv-cli, matching ci.yml's seed step. moon `command:`
+    # is a single command with no shell to compose the `$(…)` resolve, so this is
+    # a `script:` running the two-step resolve-then-run. Runs from the workspace
+    # root (runFromWorkspaceRoot below) so the tool path and lock are the same
+    # repo-root-relative strings ci.yml uses; the `cd agent-image` then puts the
+    # nix run in agent-image/ so `devenv container build` resolves this image's
     # devenv.yaml/devenv.lock, matching publish.sh. The substituters the build
     # fetches from are named in ci.yml's install-nix-action config, the reviewed
     # trust surface for this gate.
     #
-    # cache:false — nix owns its store-path caching; moon must not false-green a
-    # build it did not re-run (the same posture the fork builds take).
-    command: 'nix run github:RigelBuild/devenv/15a81f3e15619187fcbe10c2eac40878e0b4ce28#devenv -- container build agent'
+    # cache:false — nix owns its store-path caching, so moon must not false-green
+    # a build it did not re-run (the same posture the fork builds take).
+    script: 'src=$(bun tools/toolchain/devenv-cli/index.ts --lock agent-image/devenv.lock --mode flakeref); cd agent-image && nix run "$src" -- container build agent'
     options:
       cache: false
       runInCI: true
+      runFromWorkspaceRoot: true
     # The image's build closure. MIRRORS publish-agent-image.yml's
     # on.push.paths — the reviewed source of truth for what changes the
     # published artifact — so affected-detection schedules this build on exactly

devenv.nix

@@ -530,13 +530,14 @@ in
     # targets the Linux dev box.
     # agent-image: build AND load the agent base image into
     # containers-storage:compass-agent:latest (the ref the runner resolves with
-    # no pull). `container copy` builds then copies; the invocation is pinned to
-    # the shared RigelBuild/devenv fork's own CLI, pinned by rev
-    # (`nix run github:RigelBuild/devenv/<rev>#devenv`) so it cannot diverge
-    # from the fork source the agent-image module set is pinned to. Opt-in (per
-    # D5): NOT wired `after` into up — the image closure is large and rebuilding
-    # it on every `up` would violate the never-heavy-on-up constraint. The runner
-    # starts fine without the image; it only resolves it at Provision time.
+    # no pull). `container copy` builds then copies; the devenv fork rev is
+    # resolved from agent-image/devenv.lock at runtime (via
+    # tools/toolchain/devenv-cli, `nix run "$src" -- …`) so it names exactly the
+    # fork source the agent-image module set is pinned to — the same source
+    # ci.yml's seed step resolves. Opt-in (per D5): NOT wired `after` into up —
+    # the image closure is large and rebuilding it on every `up` would violate
+    # the never-heavy-on-up constraint. The runner starts fine without the image;
+    # it only resolves it at Provision time.
     "dogfood:agent-image" = {
       exec = ''
         set -euo pipefail
@@ -549,7 +550,8 @@ in
         # Removing it first makes the bare ref resolve to the image we just built.
         # `podman rmi` exits non-zero when the tag is absent, so tolerate that.
         podman rmi -f localhost/compass-agent:latest 2>/dev/null || true
-        nix run github:RigelBuild/devenv/15a81f3e15619187fcbe10c2eac40878e0b4ce28#devenv -- container copy agent
+        src=$(bun "${config.devenv.root}/tools/toolchain/devenv-cli/index.ts" --lock "${config.devenv.root}/agent-image/devenv.lock" --mode flakeref)
+        nix run "$src" -- container copy agent
       '';
       cwd = "${config.devenv.root}/agent-image";
     };

tools/agent-image-env-gate/index.ts

@@ -22,6 +22,7 @@ import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { $ } from "bun";
+import { devenvSource, flakeref } from "../toolchain/devenv-cli/core.ts";
 import { findForbiddenEnv } from "./env-check.ts";
 
 // The platform the consumer's frozen record pins (compass-native #1073,
@@ -96,13 +97,18 @@ if (import.meta.main) {
 	const agentImageDir = join(repoRoot, "agent-image");
 
 	// Build the image spec exactly as the publish lane does. devenv tracing goes
-	// to stderr; the spec store path is the last stdout line.
+	// to stderr; the spec store path is the last stdout line. The devenv fork rev
+	// is resolved from agent-image/devenv.lock at runtime (never hand-pinned), so
+	// this gate builds the exact derivation the lock names — the same source
+	// ci.yml's seed step resolves.
+	const ref = flakeref(
+		devenvSource(await Bun.file(join(agentImageDir, "devenv.lock")).text()),
+	);
 	let buildOut: string;
 	try {
-		buildOut =
-			await $`nix run github:RigelBuild/devenv/15a81f3e15619187fcbe10c2eac40878e0b4ce28#devenv -- container build agent`
-				.cwd(agentImageDir)
-				.text();
+		buildOut = await $`nix run ${ref} -- container build agent`
+			.cwd(agentImageDir)
+			.text();
 	} catch (cause) {
 		fail(`image build failed: ${String(cause)}`);
 	}