fix(agent): keep a single pip in the docker image (INT-497)

[unlisted]

Fixes INT-497.

Motivation

The published netboxlabs/orb-agent:develop image ships a broken pip: every pip3 invocation dies with ImportError: cannot import name 'get_runnable_pip' from 'pip._internal.utils.misc'. This has all controller-integrations e2e jobs red since Aug 6/7 (the entrypoint's INSTALL_DRIVERS_PATH install fails) and breaks orb-agent-pro image builds outright (they run pip3 install against this base at build time).

Root cause: the python-builder stage upgrades pip to a pinned 26.1.2, and the site-packages COPY into the final stage merges that pip file-by-file over the base image's own pip. The python:3.14-alpine base recently moved its bundled pip to 26.2.1, which restructured pip/_internal/build_env into a package. The shipped image ends up with both dist-infos and a mix of both versions' modules, and imports across them fail. Nothing in this repo changed; an upstream base refresh flipped it, and it will keep flipping whenever the base's pip and the builder pin drift apart.

Change

Keep exactly one pip in the image, owned by the stage that ships it:

• python-builder installs the app packages with the base's own pip, then uninstalls pip so it cannot leak into the COPY.
• The final stage installs the single shipped pip via a pinned self-upgrade (pip==26.2.1), which cleanly removes the base's copy first, and takes over the ensurepip wheel removal.

The builder no longer pins pip at all: its pip is throwaway tooling that never ships, so there is no version pair to keep in sync.

Testing

• Reproduced the failure on the published image: both pip-26.1.2.dist-info and pip-26.2.1.dist-info present, pip3 --version throws the ImportError above.
• Built this branch locally: single pip-26.2.1.dist-info, pip3 --version works, ensurepip wheel gone, orb-worker and device-discovery console scripts intact.
• Runtime driver-install path: pip3 install inside the built container succeeds (this is what the controller-integrations e2e entrypoint does).
• Built orb-agent-pro locally against this image (AGENT_TAG=pip-fix-local): build succeeds, all 11 nbl-* integration packages install from CodeArtifact, and the pro image inherits the single working pip.

[Copilot]

Pull request overview

Resolves a broken pip3 in the published netboxlabs/orb-agent:develop container image by ensuring only a single, consistent pip installation exists in the final runtime layer, avoiding cross-stage file merges that can mix pip module layouts.

Changes:

• Removes the pip version pin/upgrade from the python-builder stage and uninstalls pip after installing the in-repo Python backends so pip cannot leak into the final image via COPY.
• Installs a single pinned runtime pip (pip==26.2.1) in the final stage (and removes the bundled ensurepip wheel) before copying application site-packages/console scripts from the builder.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Vulnerability Scan: Failed — blocking vulnerabilities detected

Image: orb-agent:scan

Source	Library	CVE	Severity	Installed	Fixed	Title
Python	msgpack	GHSA-6v7p-g79w-8964	🟠 HIGH	1.1.2	1.2.1	MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a cau
Python	setuptools	CVE-2025-47273	🟠 HIGH	70.3.0	78.1.1	setuptools: Path Traversal Vulnerability in setuptools PackageIndex
Python	setuptools	CVE-2026-59890	🟡 MEDIUM	70.3.0	83.0.0	setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normal
usr/local/bin/orb-agent	github.com/go-git/go-git/v5	CVE-2026-71556	🟠 HIGH	v5.19.1	5.19.2	go-git: Worktree operations may follow symlinks
usr/local/bin/orb-agent	github.com/go-git/go-git/v5	CVE-2026-71557	🟡 MEDIUM	v5.19.1	5.19.2	go-git: Malicious reference names may modify files outside the reference storage

Commit: 2a31d13