feat(ops): U4 后端镜像瘦身 282MB→107MB (62%降幅)

- 移除 git/docker-cli/docker-cli-buildx (~100MB) 改为懒加载
- PipelineHandler 注入 ToolInstaller, runCheckout/runImageBuild 调 EnsureAvailable
- UpgradeTools 自动升级 DB 中 git/docker-cli preinstall→lazy
- 仅内置 linux-amd64 agent (~12MB节省), arm64/darwin 通过下载API
- kubectl 改用 install-kubectl.sh 下载 stripped 版本
- .dockerignore 排除 backend/kubectl 60MB 二进制
- Dockerfile.embed + backend/Dockerfile 同步更新
- 17/17 集成测试通过

backend/pkg/toolinstaller/installer.go

@@ -327,6 +327,8 @@ func (ti *ToolInstaller) SeedTools() {
 	var count int64
 	ti.db.Model(&model.DeployTool{}).Count(&count)
 	if count > 0 {
+		// U4: 即使已有数据也升级工具配置（git/docker-cli 从 preinstall→lazy）
+		ti.UpgradeTools()
 		return
 	}
 
@@ -351,4 +353,44 @@ func (ti *ToolInstaller) SeedTools() {
 	} else {
 		log.Printf("[ToolInstaller] Seeded %d tools", len(tools))
 	}
+
+	// U4: 新种子也执行升级
+	ti.UpgradeTools()
+}
+
+// UpgradeTools updates existing tool configs to match latest predefined definitions.
+// U4: git/docker-cli 从 preinstall 迁移到 lazy（镜像瘦身）。
+func (ti *ToolInstaller) UpgradeTools() {
+	upgrades := map[string]struct {
+		installMethod  model.ToolInstallMethod
+		installScript  string
+		description    string
+	}{
+		"git": {
+			installMethod: model.ToolLazy,
+			installScript: "apk add --no-cache git",
+			description:   "版本控制工具，流水线代码拉取使用（首次使用自动安装）",
+		},
+		"docker-cli": {
+			installMethod: model.ToolLazy,
+			installScript: "apk add --no-cache docker-cli",
+			description:   "Docker 命令行工具，流水线镜像构建/推送使用（首次使用自动安装）",
+		},
+	}
+
+	for name, up := range upgrades {
+		var tool model.DeployTool
+		if err := ti.db.Where("name = ?", name).First(&tool).Error; err != nil {
+			continue // tool not in DB, skip
+		}
+		if tool.InstallMethod == up.installMethod && tool.InstallScript == up.installScript {
+			continue // already up to date
+		}
+		log.Printf("[ToolInstaller] U4 upgrade: %s %s→%s", name, tool.InstallMethod, up.installMethod)
+		ti.db.Model(&model.DeployTool{}).Where("name = ?", name).Updates(map[string]interface{}{
+			"install_method": up.installMethod,
+			"install_script": up.installScript,
+			"description":    up.description,
+		})
+	}
 }