Why: The read-only candidate container cannot install its own toolchain, so define a separate trusted image build step.
Evidence: SELF design consistency and whitespace checks passed; full CI feasibility remains part of implementation validation.
Impact: Preserve the no-socket, read-only candidate boundary without claiming tools can be installed after the container is locked down.
Refs: Agent-System-Documents#100, Agent-System-Dev#537
weichen
68c658a091