chore(docker): lean images — drop unused playwright, dedupe grok layer, cache-stable /app layering

- agent-dev-fe / agent-qa-fe: remove playwright chromium + its system libs (~770MB each; verified unused — panel tests are vitest, e2e harness is scripted Python; pnpm kept)
- agent-grok: drop the redundant chown -R that duplicated the 149MB CLI tree into a second layer (install already runs as agent)
- agent-base + orchestrator runners: split the single /app COPY into .venv-first / source-last layers so a source-only deploy re-layers ~13MB instead of ~380MB per image
- agent-base: split the 813MB apt+node+claude-code RUN so a CLI bump no longer re-downloads the OS/node layer
- .dockerignore: exclude gitignored docs/internal from the orchestrator's docs COPY; pin uv helper image to 0.11
- verified: all four images rebuilt + runtime-probed (claude/git/jq/node/uv/pnpm/grok, import roboco, docs/alembic/agents present); .venv layer proven CACHED across a source-only change

docker/agent-base.Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
@@ -45,10 +45,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl ca-certificates git gnupg jq build-essential \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g @anthropic-ai/claude-code \
-    && npm cache clean --force \
     && apt-get purge -y --auto-remove gnupg \
-    && rm -rf /var/lib/apt/lists/* /root/.npm /tmp/*
+    && rm -rf /var/lib/apt/lists/*
+
+# Split from the apt layer above: this churns with every claude-code CLI
+# release, while the OS/node layer above stays stable across those bumps.
+RUN npm install -g @anthropic-ai/claude-code \
+    && npm cache clean --force \
+    && rm -rf /root/.npm /tmp/*
 
 RUN useradd -m -s /bin/bash agent
 
@@ -56,12 +60,17 @@ RUN useradd -m -s /bin/bash agent
 # `uv run python -m roboco.mcp.<server>`. Without it, all 10 roboco MCP
 # servers fail to start and the agent falls back to raw HTTP, losing every
 # guardrail and inline schema the MCP layer provides.
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
-# Copy the pre-built venv + source from builder, owned by agent user
-COPY --from=builder --chown=agent:agent /app /app
+# Copy the pre-built venv + source from builder, owned by agent user.
+# .venv first (invalidated only by pyproject.toml/uv.lock changes via the
+# builder's own dep-then-project split), source dirs last so an app-code-only
+# change doesn't bust the much larger .venv layer's cache.
+COPY --from=builder --chown=agent:agent /app/.venv /app/.venv
+COPY --from=builder --chown=agent:agent /app/pyproject.toml /app/uv.lock /app/README.md /app/
+COPY --from=builder --chown=agent:agent /app/roboco /app/roboco
 
 # Hook scripts: 0755 so the `agent` user (not root) can read+execute them.
 # SessionStart hook runs these as agent; stricter perms break the hook with

docker/agent-dev-fe.Dockerfile

@@ -1,36 +1,14 @@
 # Frontend Developer Agent
-# React/TypeScript development with browser automation
+# React/TypeScript development
 
 FROM roboco-agent-base
 
 USER root
 
-# Playwright system dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libnss3 \
-    libnspr4 \
-    libatk1.0-0 \
-    libatk-bridge2.0-0 \
-    libcups2 \
-    libdrm2 \
-    libxkbcommon0 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    libgbm1 \
-    libasound2 \
-    libpango-1.0-0 \
-    libcairo2 \
-    && rm -rf /var/lib/apt/lists/*
-
 # Install pnpm globally
 RUN npm install -g pnpm
 
 USER agent
 
-# Install Playwright (browsers will be installed on first run or can be cached)
-RUN npx playwright install chromium
-
 LABEL role="frontend-developer"
-LABEL description="Frontend developer agent - React, TypeScript, Playwright"
+LABEL description="Frontend developer agent - React, TypeScript"

docker/agent-grok.Dockerfile

@@ -30,10 +30,10 @@ RUN su agent -s /bin/bash -c "set -euo pipefail; export HOME=/home/agent; \
     && rm -rf /tmp/*
 
 # Entrypoint: render ~/.grok/config.toml + the per-role flags, then run grok
-# headless (overrides the base image's `claude` entrypoint).
+# headless (overrides the base image's `claude` entrypoint). ~/.grok is already
+# agent:agent-owned (installed above via `su agent`), so no chown needed here.
 COPY docker/scripts/grok-cli-agent-entrypoint.sh /app/scripts/grok-cli-agent-entrypoint.sh
-RUN chmod 0755 /app/scripts/grok-cli-agent-entrypoint.sh \
-    && chown -R agent:agent /home/agent/.grok
+RUN chmod 0755 /app/scripts/grok-cli-agent-entrypoint.sh
 
 USER agent
 

docker/agent-qa-fe.Dockerfile

@@ -1,35 +1,13 @@
 # Frontend QA Agent
-# Browser testing and accessibility tools
+# Accessibility and code-level testing tools
 
 FROM roboco-agent-base
 
 USER root
 
-# Playwright system dependencies (same as fe-dev)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libnss3 \
-    libnspr4 \
-    libatk1.0-0 \
-    libatk-bridge2.0-0 \
-    libcups2 \
-    libdrm2 \
-    libxkbcommon0 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    libgbm1 \
-    libasound2 \
-    libpango-1.0-0 \
-    libcairo2 \
-    && rm -rf /var/lib/apt/lists/*
-
 RUN npm install -g pnpm
 
 USER agent
 
-# Playwright for browser testing
-RUN npx playwright install chromium
-
 LABEL role="frontend-qa"
-LABEL description="Frontend QA agent - browser testing, accessibility, visual regression"
+LABEL description="Frontend QA agent - accessibility, code review, testing"

docker/orchestrator.Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
@@ -71,8 +71,17 @@ RUN npm install -g pnpm
 
 WORKDIR /app
 
-# Copy the already-built venv + app tree from builder
-COPY --from=builder /app /app
+# Copy the already-built venv + app tree from builder.
+# .venv first (invalidated only by pyproject.toml/uv.lock changes via the
+# builder's own dep-then-project split), source dirs last so an app-code-only
+# change doesn't bust the much larger .venv layer's cache.
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/pyproject.toml /app/uv.lock /app/README.md /app/
+COPY --from=builder /app/roboco /app/roboco
+COPY --from=builder /app/agents /app/agents
+COPY --from=builder /app/docs /app/docs
+COPY --from=builder /app/alembic.ini /app/
+COPY --from=builder /app/alembic /app/alembic
 
 # uv is needed at runtime: WorkspaceService runs `uv sync` to pre-install
 # Python cell deps, and CI commands shell out to `uv run`. The builder stage