refactor(test): content-hash image tags and testonly docker context filegroups

[sbalabanov]

Summary

Follow-ups to #439, adopting the stronger ideas from the concurrent implementation in #438.

Intent:

• refactor(test): make all Docker tests hermetic #439 seeds the compose image-tag prefix from TEST_TARGET, which is identical across worktrees: two worktrees at different revisions running the same target against one Docker daemon can interleave builds and start a container from the other worktree's image. Derive the tag from the declared input contents instead, so a collision is impossible by construction.
• The cross-compiled service binaries and Dockerfiles were exported as public, non-testonly targets and enumerated file-by-file in every test's data list. Encapsulate them so they cannot leak into production targets.

Changes:

• Image-tag prefix is now a hash of the declared inputs (compose file + staged build-context files, hashed in deterministic order): identical inputs reuse the docker build cache, different revisions never collide on a tag.
• Each service bundles its docker build-context inputs (Dockerfile, configs, cross-compiled linux binary) into a testonly docker_test_context filegroup visible only to //test/...; the go_cross_binary targets are now private and the per-file Dockerfile/queues.yaml exports are gone.
• Build-context staging streams the copy and preserves the source file mode instead of loading whole binaries into memory and stamping everything 0755.

Test Plan

• Ran //test/integration/submitqueue/gateway, //test/e2e/submitqueue, and //test/integration/extension/counter/mysql locally against a real Docker daemon (staged-context, multi-service, and no-build-context paths) and verified via docker images that image tags carry the content-hash prefix, with distinct prefixes per distinct input set.

---

_{Generated by the 🪄 pr-create skill in devexp-agent-marketplace}

🤖 Generated with Claude Code

Issues

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}