build(docker): lucebox-hub container image + CI release pipeline

[easel]

Summary

Containerization and CI plumbing for lucebox-hub. Adds a Dockerfile + docker-bake.hcl + scripts/build_image.sh that build the image, an entrypoint that emits IMAGE_INFO / HOST_INFO sidecars consumed by /props schema-3/4, and GitHub Actions for image build (docker.yml), CI integration, and luce-bench release tagging. Also ships workspace-root files the build needs (pyproject.toml, uv.lock, Makefile, .gitignore, README, .dockerignore).

This PR is the foundational docker stack — siblings #335 (lucebox-cli) and #337 (luce-bench) layer their Python surfaces on top. To keep CI green on this branch alone, the root pyproject.toml workspace members list, Dockerfile COPY directives, and Makefile test target intentionally exclude lucebox/, luce-bench/, and harness/ — those re-appear in their respective sibling diffs.

Files

• Build/runtime: Dockerfile, docker-bake.hcl, scripts/build_image.sh, server/scripts/entrypoint.sh, .dockerignore
• CI: .github/workflows/docker.yml, .github/workflows/release-luce-bench.yml, .github/workflows/ci.yml
• Workspace root: pyproject.toml, uv.lock, Makefile, .gitignore, README.md

Dependencies

• feat(lucebox): hub CLI + autotune/sweep/profile + harness adapters + shell wrapper #335 (lucebox-cli) — re-adds lucebox to the workspace members list, re-introduces the COPY ./lucebox /src/lucebox (and runtime stage copy) into the Dockerfile, restores the lucebox/**/*.py ruff include, and wires the lucebox/tests path back into make test. The lucebox CLI subcommand routing in server/scripts/entrypoint.sh is already in place; it just won't resolve until the package lands.
• feat(luce-bench): in-tree bench harness + multi-turn agent_recorded + LLM judge #337 (luce-bench) — re-adds luce-bench to workspace members, re-introduces the COPY ./luce-bench /src/luce-bench (and runtime stage copy) into the Dockerfile, restores the luce-bench/tests path in make test, and unblocks the release-luce-bench.yml tag-push workflow (currently shipped but won't fire until the luce-bench/ source tree exists).

This PR builds green on its own. Once #335 and #337 land they each add their own slice of workspace members, Dockerfile COPYs, and Makefile entries.

Test plan

• uv lock --check + uv sync --frozen pass (workspace member list matches on-disk dirs)
• uv run --frozen --extra dev ruff check . passes
• docker buildx bake cuda12-local --load produces a working lucebox-hub:cuda12 image on this branch alone
• scripts/build_image.sh produces the expected lucebox-hub:build-env and runtime images
• Entrypoint emits IMAGE_INFO / HOST_INFO that /props schema-3/4 consumes correctly
• .github/workflows/docker.yml runs cleanly in CI
• After feat(lucebox): hub CLI + autotune/sweep/profile + harness adapters + shell wrapper #335/feat(luce-bench): in-tree bench harness + multi-turn agent_recorded + LLM judge #337 land: make test runs the full lucebox + luce-bench suite; image build re-includes the lucebox CLI and the in-container python -m lucebench smoke path

[cubic-dev-ai]

5 issues found across 13 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="server/scripts/entrypoint.sh">

<violation number="1" location="server/scripts/entrypoint.sh:446">
P2: Draft autodetection can abort under `set -euo pipefail` because `sort | head -n 1` may fail with SIGPIPE when multiple matches exist.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Draft autodetection can abort under set -euo pipefail because sort | head -n 1 may fail with SIGPIPE when multiple matches exist.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At server/scripts/entrypoint.sh, line 446:

<comment>Draft autodetection can abort under `set -euo pipefail` because `sort | head -n 1` may fail with SIGPIPE when multiple matches exist.</comment>

<file context>
@@ -436,7 +440,10 @@ if [ -d "$DFLASH_DRAFT" ]; then
+        # Sort matches lexicographically so the pick is deterministic across
+        # filesystems (find's traversal order is filesystem-dependent without
+        # an explicit sort). First lexicographic match wins.
+        DRAFT_FILE="$(find -L "$DFLASH_DRAFT" -maxdepth 4 -type f -iname "$pattern" -print 2>/dev/null | sort | head -n 1)"
         if [ -n "$DRAFT_FILE" ]; then
             # Mark the family-specific match so the log line below can
</file context>

Suggested change

	DRAFT_FILE="$(find -L "$DFLASH_DRAFT" -maxdepth 4 -type f -iname "$pattern" -print 2>/dev/null | sort | head -n 1)"
	DRAFT_FILE="$(find -L "$DFLASH_DRAFT" -maxdepth 4 -type f -iname "$pattern" -print 2>/dev/null | sort | sed -n '1p')"