fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build)

v0.4.1 fixes the reproducible-build buildPhase to `cp --no-preserve=mode`, so
firmware builds succeed under proot (nix-portable's fallback when user
namespaces are unavailable in the container). Without it every phase-2 firmware
build failed with `cp: setting permissions … No such file or directory` and fell
back to the analysis-only SBOM.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile.agent

@@ -13,12 +13,6 @@ RUN --mount=type=secret,id=tramiton_token \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 
-# A throwaway stage that packs a real nix store (store paths + the validity DB)
-# into a compressed bootstrap tarball. Only the tarball is copied into the final
-# image, so we don't carry a raw /nix copy layer.
-FROM nixos/nix:latest AS nixseed
-RUN tar -C / -czf /nix-bootstrap.tar.gz nix
-
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
 
@@ -46,30 +40,20 @@ RUN pip3 install --break-system-packages semgrep
 # Install ruff for Python linting
 RUN pip3 install --break-system-packages ruff
 
-# Real nix for the tramiton reproducible-build firmware SBOM.
-#
-# nix-portable's proot fallback can't run here: user namespaces are blocked by
-# the container's default seccomp/apparmor profile, and orca exposes no way to
-# relax it. So ship a *real* nix and disable its build sandbox
-# (`sandbox = false`) — a plain gcc/make firmware build needs no user namespace,
-# so it runs fine under the locked-down profile with no proot involved.
-#
-# The store is shipped as a bootstrap tarball and seeded onto /nix at first
-# start (see docker/agent-entrypoint.sh), so a persistent /nix volume survives
-# redeploys. A missing/broken nix just falls back to the analysis-only SBOM.
-COPY --from=nixseed /nix-bootstrap.tar.gz /opt/nix-bootstrap.tar.gz
-ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
-RUN mkdir -p /etc/nix && printf '%s\n' \
-      'experimental-features = nix-command flakes' \
-      'sandbox = false' \
-      'build-users-group =' \
-      'substituters = https://cache.nixos.org' \
-      'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
-      > /etc/nix/nix.conf
+# Install nix-portable (rootless nix) so the firmware-SBOM pipeline can drive a
+# tramiton reproducible build (NixBackend). Best-effort: if the download fails,
+# the agent falls back to analysis-only firmware SBOMs (never breaks a scan).
+# The nix store lives under NP_LOCATION — mount a PERSISTENT volume there in the
+# deployment, else every firmware scan re-fetches nixpkgs + cross toolchains.
+ARG NIX_PORTABLE_VERSION=v012
+RUN curl -fsSL -o /usr/local/bin/nix-portable \
+      "https://github.com/DavHau/nix-portable/releases/download/${NIX_PORTABLE_VERSION}/nix-portable-x86_64" \
+    && chmod +x /usr/local/bin/nix-portable \
+    || { rm -f /usr/local/bin/nix-portable; echo "WARN: nix-portable install skipped; firmware SBOM uses analysis-only fallback"; }
+ENV NP_LOCATION=/data/compliance-scanner
+RUN mkdir -p /data/compliance-scanner
 
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
-COPY docker/agent-entrypoint.sh /usr/local/bin/agent-entrypoint.sh
-RUN chmod +x /usr/local/bin/agent-entrypoint.sh
 
 # Copy documentation for the help chat assistant
 COPY --from=builder /app/README.md /app/README.md
@@ -81,6 +65,5 @@ RUN mkdir -p /data/compliance-scanner/ssh
 
 EXPOSE 3001 3002
 
-# Seeds /nix (fresh volume) from the bootstrap tarball, then runs the agent.
-ENTRYPOINT ["/usr/local/bin/agent-entrypoint.sh"]
+ENTRYPOINT ["compliance-agent"]
 

docker/agent-entrypoint.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-# Seed the nix store on first start, then run the agent.
-#
-# The firmware-SBOM pipeline drives a real `nix` build (tramiton NixBackend).
-# The image ships the store as a bootstrap tarball rather than baking /nix, so a
-# persistent /nix volume (mounted empty on first deploy) gets populated once and
-# then survives redeploys. Seeding is best-effort: if it fails, the agent still
-# starts and firmware SBOMs fall back to analysis-only.
-if [ ! -e /nix/store ]; then
-  echo "agent-entrypoint: seeding /nix store from image bootstrap..."
-  mkdir -p /nix
-  if tar -C / -xzf /opt/nix-bootstrap.tar.gz; then
-    echo "agent-entrypoint: /nix store seeded."
-  else
-    echo "agent-entrypoint: WARN nix seed failed; firmware SBOM will use analysis-only fallback."
-  fi
-fi
-
-exec compliance-agent "$@"