fix(smolmachines): build agent image in launch, not prepare

When starting a smolmachines agent from the dashboard the
docker-build output rendered on top of the curses preflight
modal — the build was kicked off before the operator had
confirmed launch. The docker backend's `prepare` is pure
resolution (no docker calls); smolmachines was inconsistent
because `prepare` called `_ensure_smolmachine` which ran
`docker build` → `docker save` → `crane push` → `smolvm pack
create`, several seconds of stderr noise rendered before the
y/N prompt.

Move the pipeline:

- `_ensure_smolmachine` (+ `_SMOLMACHINE_CACHE_DIR` + `_REPO_DIR`
  + the local-registry / smolvm imports) moves from
  `backend/smolmachines/prepare.py` to
  `backend/smolmachines/launch.py`. Called right before
  `_smolvm.machine_create` so the resulting `.smolmachine`
  sidecar path lands as a local in `launch`, not on the plan.

- `SmolmachinesBottlePlan.agent_from_path: Path` becomes
  `agent_image_ref: str`. `prepare` stashes only the docker tag
  (`$CLAUDE_BOTTLE_IMAGE` || `claude-bottle:latest`); `launch`
  resolves it into the artifact at bringup.

This puts smolmachines on the same prepare-vs-launch boundary
the docker backend uses: the preflight summary in the dashboard
prints, the operator confirms, then `launch` runs — and its
stderr is routed via `_route_op_to_right_pane` (in tmux) or via
`curses.endwin` (foreground handoff) so the build output lands
cleanly.

Tests:
- `tests/unit/test_smolmachines_prepare_image.py` →
  `tests/unit/test_smolmachines_launch_image.py`, updated to
  import `_ensure_smolmachine` from `launch` rather than
  `prepare`.
- `test_smolmachines_provision.py`: plan fixture switches
  `agent_from_path` → `agent_image_ref`.

593 unit tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/smolmachines/prepare.py

@@ -1,12 +1,10 @@
 """smolmachines `_resolve_plan` (PRD 0023 chunks 2d + 4c).
 
-Resolves the per-bottle docker subnet + bundle IP, builds the
-agent's docker image from the repo Dockerfile, converts it into a
-`.smolmachine` artifact via an ephemeral local registry (smolvm's
-crane backend only reads registry refs), and assembles the guest
-env. The `.smolmachine` is cached under
-`~/.cache/claude-bottle/smolmachines/` keyed by the docker image
-ID so Dockerfile changes invalidate the cache automatically.
+Resolves the per-bottle docker subnet + bundle IP and assembles
+the guest env. The agent's docker image build → smolmachine
+pack pipeline runs in `launch.launch`, not here, so the
+dashboard's preflight modal isn't garbled by docker-build output
+before the operator has confirmed.
 
 No VM bringup — that's `launch.launch`'s job."""
 
@@ -17,7 +15,6 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 from ...backend import BottleSpec
-from ...backend.docker import util as docker_mod
 from ...backend.docker.bottle_state import (
     BottleMetadata,
     agent_state_dir,
@@ -32,23 +29,10 @@ from ...egress import Egress
 from ...git_gate import GitGate
 from ...pipelock import PipelockProxy
 from ...supervise import Supervise
-from . import smolvm as _smolvm
 from .bottle_plan import SmolmachinesBottlePlan
-from .local_registry import crane_push_tarball, ephemeral_registry
 from .util import smolmachines_bundle_subnet, smolmachines_preflight
 
 
-# Repo root, used as the `docker build` context for the agent image.
-_REPO_DIR = str(Path(__file__).resolve().parent.parent.parent.parent)
-
-
-# Per-host cache for `smolvm pack create` outputs. Keyed by the
-# image ref so re-prepares for the same image hit the cache
-# (pack create is idempotent on the smolvm side but takes several
-# seconds even when no layer is fetched).
-_SMOLMACHINE_CACHE_DIR = Path.home() / ".cache" / "claude-bottle" / "smolmachines"
-
-
 # Gateway ports the bundle exposes inside its container — pipelock
 # HTTPS proxy, git-gate's git-daemon, supervise's MCP. The agent
 # inside the smolvm guest dials these on the bundle's pinned IP.
@@ -158,16 +142,12 @@ def resolve_plan(
     prompt_file.chmod(0o600)
 
     machine_name = f"claude-bottle-{slug}"
-    # Build the agent image from the repo Dockerfile (shared with
-    # the docker backend, layer-cached) and convert it into a
-    # `.smolmachine` artifact via an ephemeral local registry. The
-    # CLAUDE_BOTTLE_IMAGE env var match the docker backend's
-    # resolve_plan default so both backends use the same image when
-    # one is built.
+    # Stash the agent image ref — `launch.launch` runs the
+    # build → pack pipeline at bringup. Honors CLAUDE_BOTTLE_IMAGE
+    # to match the docker backend's `resolve_plan` default.
     agent_image_ref = os.environ.get(
         "CLAUDE_BOTTLE_IMAGE", "claude-bottle:latest"
     )
-    agent_from_path = _ensure_smolmachine(agent_image_ref)
 
     return SmolmachinesBottlePlan(
         spec=spec,
@@ -177,7 +157,7 @@ def resolve_plan(
         bundle_gateway=gateway,
         bundle_ip=bundle_ip,
         machine_name=machine_name,
-        agent_from_path=agent_from_path,
+        agent_image_ref=agent_image_ref,
         guest_env=guest_env,
         prompt_file=prompt_file,
         proxy_plan=proxy_plan,
@@ -185,53 +165,3 @@ def resolve_plan(
         egress_plan=egress_plan,
         supervise_plan=supervise_plan,
     )
-
-
-def _ensure_smolmachine(image_ref: str) -> Path:
-    """Build the agent docker image and convert it into a
-    `.smolmachine` artifact, caching the result under
-    `~/.cache/claude-bottle/smolmachines/` keyed by the docker image
-    ID (so a Dockerfile change automatically invalidates the cache).
-
-    Returns the `.smolmachine.smolmachine` sidecar path — that's
-    the file `machine create --from` consumes (pack create produces
-    a launcher binary at `.smolmachine` plus the sidecar alongside
-    it; the sidecar is the actual artifact).
-
-    Conversion path: `docker build` (the existing layer cache
-    makes no-change rebuilds cheap) → `docker save` to a tarball
-    → spin up an ephemeral registry on a private docker network →
-    `crane push --insecure` from a one-shot container on the same
-    network → `smolvm pack create --image localhost:<host port>/...`
-    → tear down the registry + network. The crane push detour
-    sidesteps the Docker-Desktop daemon's HTTPS preference for
-    non-loopback registries — see the `local_registry` module
-    docstring for the gory details.
-
-    Each pack-create costs several seconds even on a hot cache,
-    so we skip the whole pipeline when the cached sidecar is
-    already on disk for this image ID."""
-    _SMOLMACHINE_CACHE_DIR.mkdir(parents=True, exist_ok=True)
-    docker_mod.build_image(image_ref, _REPO_DIR)
-    # `sha256:abcd...` -> `abcd...` first 16 chars: short enough to
-    # keep filenames manageable, long enough to make collisions
-    # astronomically unlikely.
-    digest = docker_mod.image_id(image_ref).split(":", 1)[-1][:16]
-    binary = _SMOLMACHINE_CACHE_DIR / f"{digest}.smolmachine"
-    sidecar = _SMOLMACHINE_CACHE_DIR / f"{digest}.smolmachine.smolmachine"
-    if sidecar.is_file():
-        return sidecar
-    tarball = _SMOLMACHINE_CACHE_DIR / f"{digest}.image.tar"
-    docker_mod.save(image_ref, str(tarball))
-    try:
-        with ephemeral_registry() as handle:
-            push_ref = f"{handle.push_endpoint}/claude-bottle:{digest}"
-            pack_ref = f"{handle.pull_endpoint}/claude-bottle:{digest}"
-            crane_push_tarball(handle, str(tarball), push_ref)
-            _smolvm.pack_create(pack_ref, binary)
-    finally:
-        # Tarball is ~500MB-1GB for the agent image; reclaim once
-        # the smolmachine artifact exists. The artifact itself is
-        # the long-lived cache entry.
-        tarball.unlink(missing_ok=True)
-    return sidecar