feat: move distribution builds to platform Docker builder

docs/local-debug-workspace.md

@@ -7,14 +7,14 @@ The local debug workspace runs the real platform API, run worker, platform_web c
 - Platform listens on `http://127.0.0.1:18080` by default.
 - platform_web listens on `http://127.0.0.1:5173` by default and proxies `/api/v1` plus `/healthz` to platform.
 - Run editable source is loaded from `RUN_SOURCE_DIR` / legacy `RUN_REPO_DIR`, defaulting to the ignored nested `./run` checkout.
-- Run source is snapshotted into `.local-debug/run/build-buckets/source/current`, then the local bootstrap worker is built into `.local-debug/run/build-buckets/bootstrap/bin/run` and registers as `run-local-debug`.
+- Run source is snapshotted into `.local-debug/run/build-buckets/source/current`; the platform mounts that snapshot read-only into the dedicated `browser-platform-distribution-builder:1.0.0` image, and the local bootstrap worker is built into `.local-debug/run/build-buckets/bootstrap/bin/run` before registering as `run-local-debug`.
 - Disposable state lives under `.local-debug/`.
 - Logs live under `.local-debug/logs/`.
 - PIDs live under `.local-debug/pids/`.
 - Go build cache for local services lives under `.local-debug/go-build-cache/`.
 - The dev plugin fixture is `plugins/examples/dev-game-plugin/manifest.json`.
 
-The workflow does not require Docker-only infrastructure, external cloud services, real game binaries, raw credentials, raw AI keys, direct run sockets, or browser/plugin direct access to run.
+The workflow requires a local Docker daemon for the platform-owned distribution builder. It does not require external cloud services, real game binaries, raw AI keys, direct run sockets, or browser/plugin direct access to run. Component auth keys remain inside the platform and the ephemeral builder input.
 
 ## Port Discipline
 
@@ -57,6 +57,11 @@ Key platform variables:
 - `PLATFORM_METADATA_PATH=.local-debug/platform/metadata.json`
 - `PLATFORM_LOG_BODY_BACKEND=file`
 - `PLATFORM_LOG_DIR=.local-debug/platform/logs`
+- `PLATFORM_BUILDER_DOCKER_BINARY=docker`
+- `PLATFORM_BUILDER_IMAGE=browser-platform-distribution-builder:1.0.0`
+- `PLATFORM_BUILDER_SOURCE_DIR=.local-debug/run/build-buckets/source/current`
+- `PLATFORM_BUILDER_WORKSPACE_DIR=.local-debug/platform/distribution-builds`
+- `PLATFORM_BUILDER_TIMEOUT_SECONDS=1800`
 - `GOCACHE=.local-debug/go-build-cache`
 
 Key run variables:
@@ -101,7 +106,9 @@ The smoke command verifies:
 - dev plugin manifest validation and registration through `POST /api/v1/game-plugins/register-manifest`.
 - run endpoint heartbeat through `GET /api/v1/run/endpoints?status=online`.
 - server lifecycle fixture setup through `POST /api/v1/server-instances/workflows/create`.
-- SCUM run package generation through Platform-dispatched `distribution.build` when the endpoint advertises build capability.
+- minimal server creation with plugin type and name only, followed by an explicit post-creation runtime binding.
+- host-native Run generation through the platform-owned Docker builder, artifact download and execution, then generated Run registration plus a subsequent heartbeat without `distribution.build` authority.
+- SCUM run package generation through the platform-owned Docker builder, without any Run endpoint advertising `distribution.build`.
 - latest run download opening through `POST /api/v1/server-instances/{id}/run/download`.
 - generated artifact content reads through `/api/v1/artifacts/{id}/content` with chunk, total size, and checksum verification.
 - job, log stream, artifact, marketplace, and server list references.
@@ -146,7 +153,7 @@ Required walkthrough:
 - Open 插件市场.
 - Open 用户管理.
 - Open AI 提供商管理.
-- Inspect `server-local-debug` server detail, plugin controls or marketplace detail, operation history, log references, and artifact references.
+- Inspect the invocation-scoped example server ID recorded in `.local-debug/smoke/run-build-config.env`, its generated Run endpoint, plugin controls or marketplace detail, operation history, log references, and artifact references.
 - Scan visible browser text for forbidden fragments: `/Users/`, `/private/`, `unix://`, `tcp://`, `Bearer `, `sk-`, `password=`, `apiKeyRef`, `rawApiKey`, run session tokens, direct run URLs, and plugin-owned transport details.
 
 Acceptance requires logical IDs, platform routes, job refs, log refs, artifact refs, and safe metadata only.
@@ -182,6 +189,7 @@ The start script wraps these commands with the local debug environment:
 ```bash
 (cd platform && go run ./cmd/platform)
 source scripts/local-debug/env.sh
+local_debug_prepare_distribution_builder
 local_debug_build_bootstrap_run
 "$RUN_BOOTSTRAP_BIN"
 npm --prefix platform_web run dev -- --port 5173