fix(remote-worker): install the capabilities the leaf advertises

cmd/worker/main.go's `probed` list advertises bash, rg, base64, file, python3 and
git as this worker's Hello.capabilities, and its comment states "the pool will
eventually match on these, so they must be true". Three of the six were not
installed: on a real VM the leaf reported `caps=[bash base64 file]`, advertising a
set it could not honour.

It also gates measurement fidelity. Spec §2.3's duty bases were derived from
workloads whose git operations cost ~470ms, so without git in the sandbox an E8 tool
call can only be a ~0ms no-op -- the hands tier is exercised structurally but carries
no load, and the measured duty cycle then describes a cheaper workload than the basis
it is compared against.

Adds git and python3 to both image definitions. `rg` stays absent deliberately:
ripgrep is not in the UBI 9 repositories, so honouring it means EPEL or vendoring a
binary into a demo image. Recorded as a known gap rather than a silent one -- whoever
needs capability-matched scheduling should add it or shorten `probed`.

The DL3041 ignore directives were repositioned to abut their RUN lines, since a
comment block between them silences nothing.

Verified: hadolint and the rest of make lint clean, remote-worker go tests pass.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

remote-worker/Dockerfile

@@ -26,8 +26,22 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/remote-worker ./cm
 # bumps for the same reason .hadolint.yaml already ignores DL3018 for Alpine.
 # hadolint ignore=DL3007
 FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
+# git and python3 are here because cmd/worker/main.go's `probed` list advertises
+#   bash, rg, base64, file, python3, git
+# as this worker's Hello.capabilities, and its comment says "the pool will eventually match on
+# these, so they must be true". Three of the six were not: on a real VM the leaf reported
+# `caps=[bash base64 file]`, so it advertised a set it could not honour.
+#
+# It also matters for measurement. Spec §2.3's duty bases were derived from workloads whose git
+# operations cost ~470ms; without git in the sandbox, an E8 tool call can only be a ~0ms no-op, so
+# the hands tier is exercised structurally but carries no load and the measured duty cycle describes
+# a cheaper workload than the basis it is compared against.
+#
+# `rg` is deliberately still absent: ripgrep is not in the UBI 9 repositories, so honouring it means
+# either EPEL or vendoring a binary into a demo image. Left as a known gap rather than a silent one —
+# whoever needs capability-matched scheduling should either add it or shorten `probed`.
 # hadolint ignore=DL3041
-RUN microdnf install -y --nodocs bash coreutils-single findutils file \
+RUN microdnf install -y --nodocs bash coreutils-single findutils file git python3 \
     && microdnf clean all
 COPY --from=build /out/remote-worker /usr/local/bin/remote-worker
 # The harness execs every tool call from its sandbox working directory, which defaults to

remote-worker/Dockerfile.runtime

@@ -10,8 +10,12 @@
 # bumps for the same reason .hadolint.yaml already ignores DL3018 for Alpine.
 # hadolint ignore=DL3007
 FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
+# git and python3: see the same block in ./Dockerfile. cmd/worker/main.go's `probed` list advertises
+# them as this worker's capabilities and they were not present, and a sandbox without git cannot run
+# a tool call resembling the workloads spec §2.3's duty bases were measured from. `rg` remains absent
+# (not in the UBI 9 repositories) — a known gap, not a silent one.
 # hadolint ignore=DL3041
-RUN microdnf install -y --nodocs bash coreutils-single findutils file \
+RUN microdnf install -y --nodocs bash coreutils-single findutils file git python3 \
     && microdnf clean all
 COPY remote-worker /usr/local/bin/remote-worker
 # See the same block in ./Dockerfile: the harness execs tool calls from /workspace (the default