fix(docker): make the pipeline image build and run

[flamboh]

Two defects found running the container on a real machine for the first time. Both are container-only; no Rust or dashboard code changes.

1. Build failed: rustup ran interactively

error: Unable to run interactively. Run with -y to accept defaults, --help for additional options

The rust-builder stage passed --yes to rustup's installer. That looks equivalent to -y, but rustup-init.sh parses its own arguments to decide whether it needs a tty and explicitly skips long options:

if [ "${arg%%--*}" = "" ]; then
    # Long option (other than --help);
    # don't attempt to interpret it.
    continue
fi
while getopts :hqy sub_arg "$arg"; do
    case "$sub_arg" in
        y)  # user wants to skip the prompt -- we don't need /dev/tty
            need_tty=no ;;

So --yes never cleared need_tty, and with no tty during docker build the installer bailed out. Fixed by using -y. The other flags (--profile, --default-toolchain) are consumed by the rustup-init binary rather than the shell wrapper, so they were never affected.

2. Every pipeline run failed: no time zone database

Error: invalid pipeline time: failed to find time zone `America/Los_Angeles` since there is no time zone database configured

The pipeline resolves named IANA zones through jiff and defaults to America/Los_Angeles (tools/netflow-db/src/main.rs, feed.rs). jiff reads the system tzdb from /usr/share/zoneinfo, but the runtime stage installed only ca-certificates and libbz2-1.0 under --no-install-recommends, so no tzdb existed in the image. This never reproduces on a host, where the OS supplies one.

Fixed by installing tzdata in the runtime stage. The build-time smoke check now also asserts /usr/share/zoneinfo/America/Los_Angeles exists, so a future dependency trim fails the build instead of shipping a broken image.

Verification

Fix 1 is confirmed against the current sh.rustup.rs (910 lines): the long-option skip is at lines 139-143 and the abort at lines 179-181, matching the reported error verbatim. Fix 2 is confirmed by the reported failure plus the runtime stage's package list.

bun run format and bun run typecheck pass.

Both defects are the docker build gap called out as unverified in #98 and #100 — I have no docker-group access on the authoring host, so the image had never been built end to end. Please re-run:

./scripts/netflow-db-docker.sh --build contract-version

Expected: the image builds and prints 4. Note the nfdump-builder stage was CANCELED rather than failed on the previous attempt, so it is still untested in a container; it does pass natively, including the fork's runatlantis.sh suite.

---

Authored with Claude Code (Fable 5).