[intel352]

Summary

Match the workflow-migrate image's Go builder to the module's exact required version: 1.26.4 to 1.26.5. Add a regression reading real go.mod metadata and the actual Dockerfile builder stage.

Scope Manifest

Approved ADR 0152 recovery: 25 tasks / 14 PRs, original outcomes retained.
This PR is Task 23 / PR 12, branch fix/migration-image-toolchain-20261003.
Workspace design/plan: docs/plans/2026-10-02-workflow-compute-recovery-design.md and docs/plans/2026-10-02-workflow-compute-recovery-0a.md.

Exactly two files. The existing ordered-runner review stays closed; no unrelated CLI/runtime feature. The failed draft v0.4.0 tag remains immutable.

Verification

• TDD exact-pin regression: old 1.26.4 RED, matched 1.26.5 GREEN, production-only revert RED/restored GREEN.
• Fresh lead full race with the repository's actual CI-supported WORKFLOW_MIGRATE_TEST_DSN: 10 packages / 156 cases / zero failures or skips, including real PostgreSQL and standalone public-runner consumer.
• Fresh full build/vet/lint passed; formatting/diff check clean.
• One initial independent adversarial pass: SHIP-IT, zero findings, structural scope and all bug classes checked. No repeated ordered-runner/design review.
• Scope lock strict 25/14 PASS.

Initial no-DSN run exposed the unchanged embedded-Postgres fallback sharing one runtime directory across packages; failed log retained and only the owned failing test stopped. A first local fixture startup was attempted before initdb finished and was not counted as a pass. After the isolated PostgreSQL cluster reported ready, the complete unchanged suite passed through the same DSN contract used by CI. Only that temporary cluster was stopped; no shared embedded/system database or Docker engine cleanup.

Runtime Launch Transcript

docker build --platform linux/amd64 -f cmd/workflow-migrate/Dockerfile \
  -t <owned-local-image> --progress=plain .
exit 0, builder golang:1.26.5-alpine
image sha256:10f129d4ca71c42be9051e2f627ff89dec8beff57c1ed877d1343bf2d6a48af5
docker image inspect <owned-local-image>
linux/amd64 user=65532 entrypoint=["/workflow-migrate"]
docker run --rm --platform linux/amd64 --network none <owned-local-image> --help
Run, inspect, and test database migrations via golang-migrate, goose, or atlas.
exit 0
go version -m <binary-extracted-from-exact-image>
go1.26.5, GOOS=linux, GOARCH=amd64, CGO_ENABLED=0

The original CLI has no --version or version command; those probes correctly returned unsupported-command errors. No command was invented. Actual binary metadata and image identity verify the builder/platform; the local image is supporting evidence, not released provenance. Final help launch failure-signature scrape is clean. Owned proof containers were removed by exact IDs only; no engine restart/prune.

Rollback

Do not retarget v0.4.0 or pin its failed image. After green exact-merge checks, publish and verify a new immutable successor before private-app consumption. No deployment/cloud mutation.