fix: pin the claude CLI to an exact version in the CI image + tripwire

The image installed @anthropic-ai/claude-code UNPINNED and rebuilt weekly
'to pick up CLI updates' — while bun sat carefully pinned at 1.3.13 two RUN
lines above. The PTY harness screen-scrapes this CLI's TUI, and that drift
broke it three separate times (welcome-screen wedge on 2.1.233, skillify
HOME discovery on 2.1.237, guard/freeze hooks on 2.1.162), each debugged as
a flake first. Pin 2.1.251 (current latest), bump deliberately via a PR
that runs the PTY gate, and enforce with test/ci-image-cli-pin.test.ts:
any global npm install in Dockerfile.ci without an exact @X.Y.Z pin fails
the free suite. The weekly ci-image cron stays as a cheap tag self-heal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/docker/Dockerfile.ci

@@ -74,8 +74,15 @@ ENV BUN_INSTALL="/usr/local"
 RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL https://bun.sh/install \
     | bash -s "bun-v1.3.13"
 
-# Claude CLI
-RUN npm i -g @anthropic-ai/claude-code
+# Claude CLI — pinned to an EXACT version, same discipline as the bun pin
+# above. The PTY harness (test/helpers/claude-pty-runner.ts) screen-scrapes
+# this CLI's TUI (trust dialog, input prompt, spinner glyphs); an unpinned
+# install rebuilt weekly rode the TUI wherever it drifted, and that drift
+# broke the harness three separate times (welcome-screen wedge on 2.1.233,
+# skillify HOME discovery on 2.1.237, guard/freeze hooks on 2.1.162).
+# Bump deliberately, via a PR that runs the PTY gate against the new TUI.
+# test/ci-image-cli-pin.test.ts fails the free suite if this pin is removed.
+RUN npm i -g @anthropic-ai/claude-code@2.1.251
 
 # Playwright system deps (Chromium) — needed for browse E2E tests
 RUN npx playwright install-deps chromium

.github/workflows/ci-image.yml

@@ -1,8 +1,12 @@
 name: Build CI Image
 on:
-  # Rebuild weekly (Monday 4am UTC) to pick up CLI updates — deliberately 2h
-  # BEFORE evals-periodic's 6am cron so the weekly eval run finds a fresh
-  # image instead of racing a half-pushed tag or duplicating the build.
+  # Weekly self-heal (Monday 4am UTC) — deliberately 2h BEFORE
+  # evals-periodic's 6am cron so the weekly eval run finds the image instead
+  # of racing a half-pushed tag. With the claude CLI pinned in Dockerfile.ci
+  # (v1.76+), this cron no longer pulls CLI updates: when the content-hash
+  # tag already exists it's a ~30s no-op, and it only rebuilds if the tag
+  # was somehow lost. CLI bumps happen by editing the Dockerfile pin in a PR
+  # that runs the PTY gate against the new TUI.
   schedule:
     - cron: '0 4 * * 1'
   # Rebuild on Dockerfile or lockfile changes. package.json is deliberately