chore: Reduce AgentCore image size and harden Docker build

[jeromevdl]

Summary

Reduces the AgentCore container image size and improves build reproducibility and security.

The primary issue was a recursive chown over /opt, which duplicated the installed CLI and application files into a new Docker layer.

Changes

• Replace recursive chown -R with ownership-correct directory creation.
• Remove insecure APT repository options.
• Pin Kiro, Claude Code, OpenCode, Codex, Bun, and uv versions.
• Verify downloaded CLI artifacts using SHA-256 checksums.
• Pin the ARM64 Node.js base image by digest.
• Clean npm caches after installation.
• Remove the global safe.directory '*' Git bypass.
• Register only exact runtime checkout paths as trusted Git directories.
• Add tests for scoped Git trust registration.

Image-size results

ECR compressed image size:

Version	Size
Previous	1.867 GB
Updated	1.228 GB

Reduction 638.9 MB (34.2%)

The updated image uses approximately 61.4% of AgentCore’s 2 GB limit, leaving about 771.7 MB of headroom.

Validation

• ARM64 Docker image built successfully.
• Dockerfile static validation passed.
• Formatting passed for changed files.
• Lint passed with pre-existing warnings only.
• Secret scanning passed.
• 126 test files passed.
• 2,500 tests passed.
• Deployed and tested with a new intent