fix(ci): avoid github api cache bust in project image

Author: konard

packages/container/src/core/templates/dockerfile-prelude.ts

@@ -84,7 +84,7 @@ RUN printf "%s\\n" "ALL ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/zz-all \
   && chmod 0440 /etc/sudoers.d/zz-all`
 
 const planToGitBranch = "main"
-const planToGitCommitMetadataUrl = `https://api.github.com/repos/ProverCoderAI/plan-to-git/commits/${planToGitBranch}`
+const planToGitCommitPatchUrl = `https://github.com/ProverCoderAI/plan-to-git/commit/${planToGitBranch}.patch`
 
 // CHANGE: install plan-to-git in generated project containers.
 // WHY: issue #397 requires multi-agent plan capture, Claude Code hooks, temp-backed state, and explicit PR sync.
@@ -94,11 +94,11 @@ const planToGitCommitMetadataUrl = `https://api.github.com/repos/ProverCoderAI/p
 // FORMAT THEOREM: image_build_success -> executable(/usr/local/bin/plan-to-git)
 // PURITY: SHELL
 // EFFECT: Docker build downloads and installs the current main branch Rust CLI from GitHub.
-// INVARIANT: plan-to-git is available on PATH with Claude hooks and sync --pr before agent hooks or git post-push actions run; moving main changes the remote ADD input and invalidates the install layer.
+// INVARIANT: plan-to-git is available on PATH with Claude hooks and sync --pr before agent hooks or git post-push actions run; moving main changes the remote patch ADD input and invalidates the install layer without GitHub API quota dependency.
 // COMPLEXITY: O(network + cargo_build)
 const renderDockerfilePlanToGit = (): string =>
   `# Install plan-to-git for multi-agent plan capture and explicit PR sync (issue #397)
-ADD ${planToGitCommitMetadataUrl} /tmp/docker-git-plan-to-git-main.json
+ADD ${planToGitCommitPatchUrl} /tmp/docker-git-plan-to-git-main.patch
 RUN cargo install --git https://github.com/ProverCoderAI/plan-to-git --branch ${planToGitBranch} --locked --bins --root /usr/local \
   && /usr/local/bin/plan-to-git --help >/dev/null \
   && /usr/local/bin/plan-to-git --help | grep -q -- "--repo" \

packages/container/tests/core/templates.test.ts

@@ -208,7 +208,7 @@ describe("renderDockerfile", () => {
       "rtk --version",
       "rtk gain >/dev/null 2>&1 || true",
       "# Install plan-to-git for multi-agent plan capture and explicit PR sync (issue #397)",
-      "ADD https://api.github.com/repos/ProverCoderAI/plan-to-git/commits/main /tmp/docker-git-plan-to-git-main.json",
+      "ADD https://github.com/ProverCoderAI/plan-to-git/commit/main.patch /tmp/docker-git-plan-to-git-main.patch",
       "cargo install --git https://github.com/ProverCoderAI/plan-to-git --branch main --locked --bins --root /usr/local",
       "/usr/local/bin/plan-to-git --help >/dev/null",
       '/usr/local/bin/plan-to-git --help | grep -q -- "--repo"',

packages/lib/src/usecases/auth-claude.ts

@@ -70,15 +70,16 @@ const persistClaudeOauthToken = (
     const tokenPath = claudeOauthTokenPath(accountPath)
     const tempDir = yield* _(fs.makeTempDirectory({ directory: accountPath, prefix: ".oauth-token-write-" }))
     const tempPath = path.join(tempDir, ".oauth-token")
+    const cleanupTempDir = fs.remove(tempDir, { recursive: true, force: true }).pipe(
+      Effect.orElseSucceed(() => void 0)
+    )
     yield* _(
       Effect.gen(function*(_) {
         yield* _(fs.writeFileString(tempPath, formatClaudeOauthTokenFile(token), { mode: claudeOauthTokenFileMode }))
         yield* _(fs.chmod(tempPath, claudeOauthTokenFileMode))
         yield* _(fs.rename(tempPath, tokenPath))
         yield* _(fs.chmod(tokenPath, claudeOauthTokenFileMode))
-      }).pipe(
-        Effect.ensuring(fs.remove(tempDir, { recursive: true, force: true }).pipe(Effect.orElseSucceed(() => void 0)))
-      )
+      }).pipe(Effect.ensuring(cleanupTempDir))
     )
   })