kickoff --container has no usable agent image: crosslink container build broken (COPY name mismatch) + default image unpublished

[magnificentlycursed]

The working kickoff --container dispatch path has no usable agent image out of the box

Context: investigation on #55 established that kickoff run --container is the working headless-dispatch vehicle (no TTY → the folder-trust dialog can't render → --dangerously-skip-permissions proceeds). But a user can neither pull nor locally build the agent image it needs, for two independent reasons.

1. crosslink container build is broken (COPY name mismatch)

build() stages the binary as crosslink (src/commands/container.rs:254, std::fs::copy(&binary, build_path.join("crosslink"))), but the shipped Dockerfile expects an arch-suffixed name:

# resources/container/Dockerfile:47
COPY crosslink-${TARGETARCH} /usr/local/bin/crosslink

So every crosslink container build fails at that step:

COPY --chown=agent crosslink-amd64 /usr/local/bin/crosslink
ERROR: "/crosslink-amd64": not found

just build-image works because it stages crosslink-${DOCKER_ARCH} (justfile), matching the Dockerfile — but crosslink container build, the command the CLI's own error hint recommends ("rebuild locally (just build-image or crosslink container build)", container.rs:205), does not. This is platform-independent (the name never matches).

A secondary problem on non-Linux hosts: find_crosslink_binary() returns current_exe() (container.rs:74), so on macOS container build would copy a darwin binary into a Linux image even if the name matched. The correct source is a cross-compiled *-unknown-linux-musl binary (what just build-image produces).

Fix: crosslink container build should either name the staged binary crosslink-<arch> to match the Dockerfile (and cross-compile a Linux target rather than copying current_exe() on non-Linux hosts), or the Dockerfile should accept a plain crosslink. Aligning the two build paths on one contract would also prevent future drift.

2. The default agent image is unpublished

DEFAULT_AGENT_IMAGE = "ghcr.io/dollspace-gay/crosslink-agent:latest" (src/commands/kickoff/types.rs:11) is not published, so kickoff run --container fails with not found and cannot pull it:

Error: docker container launch failed: Unable to find image 'ghcr.io/dollspace-gay/crosslink-agent:latest' locally

The repo already has .github/workflows/container-image.yml, which builds+publishes correctly (musl per-arch, crosslink-<arch> staging) on push to develop and on v* tags — but IMAGE_NAME is dollspace-gay/crosslink-agent, so it only publishes under the dollspace org. Publishing a :latest/:nightly tag there would make the working --container path usable out of the box (this is the successor to forecast-bio/crosslink#576 for the new org).

Combined impact: the one dispatch path that works headlessly (#55) is currently unreachable without a working local build, and the local build command is broken.

Authored by Claude Code on behalf of @magnificentlycursed.