Pin CLI versions in all Dockerfiles using ARG for reproducible builds

[thepagent]

Problem

Some Dockerfiles install CLI tools without pinning versions. Combined with docker/build-push-action GHA layer caching (mode=max), the npm install layer gets CACHED and never picks up new versions — or worse, a cache miss silently pulls a different version, making builds non-reproducible.

Current state:

Dockerfile	Install	Pinned?
Dockerfile (kiro)	curl ... kirocli.zip	❌ No version in URL
Dockerfile.codex	npm install -g @zed-industries/codex-acp@0.9.5 @openai/codex	⚠️ codex-acp pinned, @openai/codex not pinned
Dockerfile.claude	npm install -g @agentclientprotocol/claude-agent-acp@0.25.0 @anthropic-ai/claude-code	⚠️ adapter pinned, @anthropic-ai/claude-code not pinned
Dockerfile.gemini	npm install -g @google/gemini-cli	❌ Not pinned
Dockerfile.copilot	npm install -g @github/copilot@1	⚠️ Major range only (@1)

Proposed Fix

Use ARG with explicit versions for every CLI dependency so that:

1. Changing the version busts the Docker layer cache automatically
2. Builds are reproducible
3. Version bumps are visible in git diff

Example pattern:

ARG GEMINI_VERSION=0.37.0
RUN npm install -g @google/gemini-cli@${GEMINI_VERSION} --retry 3

Apply this to all five Dockerfiles:

• Dockerfile — pin Kiro CLI version
• Dockerfile.codex — pin @openai/codex version
• Dockerfile.claude — pin @anthropic-ai/claude-code version
• Dockerfile.gemini — pin @google/gemini-cli version
• Dockerfile.copilot — pin @github/copilot to exact version

[github-actions]

⚠️ Could not detect an issue template. Please make sure this issue was created using one of the available templates and that the corresponding label (bug, feature, documentation, guidance) is present.

Available templates: Bug Report, Feature Request, Documentation, Guidance