The export/import flatten has been a manual ritual. `docker export |
docker import` drops the image config entirely, so it has to be rebuilt
by hand every time — and a silently lost ENTRYPOINT or PATH produces an
image that builds, ships, and then fails to start. This scripts it, emits
every value in JSON form (so CODERAI_EXTRA_ARGS' spaces survive), and
then VERIFIES the flattened config matches the source before it moves the
base tag. It refuses to retag on a mismatch.

It also strips secret-valued env vars. HF_TOKEN was baked into the image
config — readable by anyone who can pull it, `docker image inspect` is
enough — and had been carried forward since at least the 20260909 base.
It arrives via `docker commit` of a container started with -e; the repo
itself is clean (not in any tracked file, not in history). run_oci.sh
already passes the token at runtime, so removing it from the image
changes nothing. Names are reported, values never echoed, and the
equality check knows the strips are intentional.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY