feat(ops): U4 后端镜像瘦身 282MB→107MB (62%降幅)

- 移除 git/docker-cli/docker-cli-buildx (~100MB) 改为懒加载
- PipelineHandler 注入 ToolInstaller, runCheckout/runImageBuild 调 EnsureAvailable
- UpgradeTools 自动升级 DB 中 git/docker-cli preinstall→lazy
- 仅内置 linux-amd64 agent (~12MB节省), arm64/darwin 通过下载API
- kubectl 改用 install-kubectl.sh 下载 stripped 版本
- .dockerignore 排除 backend/kubectl 60MB 二进制
- Dockerfile.embed + backend/Dockerfile 同步更新
- 17/17 集成测试通过

backend/controller/pipeline.go

@@ -9,6 +9,7 @@ import (
 	"ezops/model"
 	"ezops/middleware"
 	ezredis "ezops/pkg/redis"
+	"ezops/pkg/toolinstaller"
 
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -53,13 +54,14 @@ func validateCode(db *gorm.DB, code string, excludeID uint) string {
 
 // PipelineHandler 流水线管理器
 type PipelineHandler struct {
-	db    *gorm.DB
-	cache ezredis.Cache
+	db            *gorm.DB
+	cache         ezredis.Cache
+	toolInstaller *toolinstaller.ToolInstaller
 }
 
 // NewPipelineHandler 创建流水线处理器
-func NewPipelineHandler(db *gorm.DB, cache ezredis.Cache) *PipelineHandler {
-	return &PipelineHandler{db: db, cache: cache}
+func NewPipelineHandler(db *gorm.DB, cache ezredis.Cache, ti *toolinstaller.ToolInstaller) *PipelineHandler {
+	return &PipelineHandler{db: db, cache: cache, toolInstaller: ti}
 }
 
 // PipelineListItem 列表项（含最近一次运行摘要）// Logan.Li

backend/controller/pipeline_executor.go

@@ -222,6 +222,13 @@ func (h *PipelineHandler) runCheckout(url, branch, workspace string, logFn func(
 	}
 	logFn("info", "代码检出", "> Git 拉取 "+url+" (分支: "+branch+")")
 
+	// U4: 确保工具可用（slim 镜像模式下 git 为懒加载）// Logan.Li
+	if h.toolInstaller != nil {
+		if err := h.toolInstaller.EnsureAvailable("git"); err != nil {
+			return fmt.Errorf("git 不可用（安装失败）: %v", err)
+		}
+	}
+
 	cmd := exec.Command("git", "clone", "--depth", "1", "-b", branch, url, workspace)
 	output, err := cmd.CombinedOutput()
 	// 流式输出到日志
@@ -429,6 +436,14 @@ func (h *PipelineHandler) runDockerBuild(workspace string, pipeline model.Pipeli
 	}
 
 	logFn("info", "镜像打包", fmt.Sprintf(">>> Docker 构建 (dockerfile: %s)", dfPath))
+
+	// U4: 确保 Docker CLI 可用（slim 镜像模式下 docker-cli 为懒加载）// Logan.Li
+	if h.toolInstaller != nil {
+		if err := h.toolInstaller.EnsureAvailable("docker-cli"); err != nil {
+			return fmt.Errorf("docker 不可用（安装失败）: %v", err)
+		}
+	}
+
 	cmd := exec.Command("docker", "build", "-t", fullImage, "-f", dfPath, ".")
 	cmd.Dir = buildDir
 	out, err := cmd.CombinedOutput()