feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)

Dockerfile.agent

@@ -40,6 +40,19 @@ RUN pip3 install --break-system-packages semgrep
 # Install ruff for Python linting
 RUN pip3 install --break-system-packages ruff
 
+# Install nix-portable (rootless nix) so the firmware-SBOM pipeline can drive a
+# tramiton reproducible build (NixBackend). Best-effort: if the download fails,
+# the agent falls back to analysis-only firmware SBOMs (never breaks a scan).
+# The nix store lives under NP_LOCATION — mount a PERSISTENT volume there in the
+# deployment, else every firmware scan re-fetches nixpkgs + cross toolchains.
+ARG NIX_PORTABLE_VERSION=v012
+RUN curl -fsSL -o /usr/local/bin/nix-portable \
+      "https://github.com/DavHau/nix-portable/releases/download/${NIX_PORTABLE_VERSION}/nix-portable-x86_64" \
+    && chmod +x /usr/local/bin/nix-portable \
+    || { rm -f /usr/local/bin/nix-portable; echo "WARN: nix-portable install skipped; firmware SBOM uses analysis-only fallback"; }
+ENV NP_LOCATION=/data/compliance-scanner
+RUN mkdir -p /data/compliance-scanner
+
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
 
 # Copy documentation for the help chat assistant