claude: fold in old sow-tools

docker/Dockerfile

@@ -6,15 +6,15 @@
 # and ships them on a static base. The `crucible` dispatcher is the entrypoint;
 # consumer CI can also call the standalone crucible-<name> binaries by path.
 #
-# NOTE (Phase 5 scaffold): the binaries are pure stdlib and fail closed until
-# the operator migrates the internal pipeline. When the music pipeline is wired
-# it needs ffmpeg at runtime — switch the final stage to a debian-slim base with
-# ffmpeg then (see docs/migration-from-nwn-tool.md).
+# NOTE: the internal pipeline is migrated and the music conversion path is wired,
+# so the runtime stage is debian-slim with ffmpeg on PATH (BMU encode/decode).
+# See docs/migration-from-nwn-tool.md.
 
 FROM golang:1.26-alpine AS build
 WORKDIR /src
 RUN apk add --no-cache git
-# go.sum is optional while the scaffold has no external deps.
+# go.sum is committed now that the migrated packages pull golang.org/x/text and
+# gopkg.in/yaml.v3; the glob keeps the build working if it is ever absent.
 COPY go.mod go.sum* ./
 RUN go mod download
 COPY . .
@@ -29,7 +29,14 @@ RUN set -eux; \
         -o "/out/${name}" "${dir}"; \
     done
 
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM debian:12-slim
+# ffmpeg: the migrated music pipeline shells out to it for BMU conversion.
+# ca-certificates: builders fetch published manifests over HTTPS.
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ffmpeg ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    useradd --system --create-home --uid 65532 nonroot
 COPY --from=build /out/ /usr/local/bin/
 USER nonroot
 ENTRYPOINT ["/usr/local/bin/crucible"]