fix: decouple runtime-from-dist image from go-builder stage

[CJackHwang]

Motivation

• The release buildx failed because runtime-from-dist indirectly depended on the go-builder stage via COPY --from=go-builder /etc/ssl/certs/ca-certificates.crt, which forced an unnecessary go build (with -X ds2api/internal/version.BuildVersion=...) to run and fail during the Docker multi-stage build.

Description

• Update Dockerfile runtime-base stage to install ca-certificates via apt-get instead of copying them from the go-builder stage, removing the unintended dependency on go-builder and ensuring docker buildx --target runtime-from-dist does not execute the source compile.
• No other source files were modified; the change is limited to replacing the COPY --from=go-builder /etc/ssl/certs/ca-certificates.crt ... with an apt-get install ca-certificates sequence in Dockerfile.

Testing

• Ran release gating scripts ./tests/scripts/check-stage6-manual-smoke.sh which passed (output: stage6_manual_smoke=PASS).
• Ran line-gate check ./tests/scripts/check-refactor-line-gate.sh which passed (output: checked=130 missing=0 over_limit=0).
• Ran unit suite ./tests/scripts/run-unit-all.sh which completed successfully with all tests passing (summary: # pass 41 # fail 0).
• Built Web UI with npm ci --prefix webui and npm run build --prefix webui which succeeded, and replayed the multi-platform Go build loop locally using go build -ldflags='-X ds2api/internal/version.BuildVersion=...' for the target set, which completed successfully; full docker buildx runs could not be executed here because Docker is unavailable, but the stage-coupling root cause has been removed.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ds2api	Ready	Preview, Comment	Mar 20, 2026 5:32pm

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.