refactor(test): content-hash image tags and testonly docker context filegroups

Summary:
Follow-ups to #439, adopting the stronger ideas from the concurrent implementation in #438.

Intent:
- #439 seeds the compose image-tag prefix from TEST_TARGET, which is identical across worktrees: two worktrees at different revisions running the same target against one Docker daemon can interleave builds and start a container from the other worktree's image. Derive the tag from the declared input contents instead, so a collision is impossible by construction.
- The cross-compiled service binaries and Dockerfiles were exported as public, non-testonly targets and enumerated file-by-file in every test's data list. Encapsulate them so they cannot leak into production targets.

Changes:
- Image-tag prefix is now a hash of the declared inputs (compose file + staged build-context files, hashed in deterministic order): identical inputs reuse the docker build cache, different revisions never collide on a tag.
- Each service bundles its docker build-context inputs (Dockerfile, configs, cross-compiled linux binary) into a testonly docker_test_context filegroup visible only to //test/...; the go_cross_binary targets are now private and the per-file Dockerfile/queues.yaml exports are gone.
- Build-context staging streams the copy and preserves the source file mode instead of loading whole binaries into memory and stamping everything 0755.

Test Plan:
- Ran //test/integration/submitqueue/gateway, //test/e2e/submitqueue, and //test/integration/extension/counter/mysql locally against a real Docker daemon (staged-context, multi-service, and no-build-context paths) and verified via `docker images` that image tags carry the content-hash prefix, with distinct prefixes per distinct input set.

---

<sub>Generated by the 🪄 [pr-create](https://sg.uberinternal.com/code.uber.internal/uber-code/devexp-agent-marketplace/-/blob/claude-code/plugins/dev/uber-dev/skills/pr-create/SKILL.md) skill in devexp-agent-marketplace</sub>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: sbalabanov-zz

AGENTS.md

@@ -309,7 +309,7 @@ deps = [
 
 **Integration tests** use Docker Compose via `testutil.ComposeStack`:
 - Package naming: folder name as package (NOT `*_test` suffix)
-- Bazel: add `tags = ["integration", "requires-network"]` and `data = [...]` for every input the test reads (compose file, schema dirs, Dockerfiles, Bazel-built `*_linux` service binaries). Tests are hermetic: never resolve the repo root — resolve inputs from runfiles via `testutil.Runfile` and stage docker build contexts with `testutil.WithBuildContext`.
+- Bazel: add `tags = ["integration", "requires-network"]` and `data = [...]` for every input the test reads (compose file, schema dirs, and each service's `docker_test_context` filegroup bundling its Dockerfile, configs, and Bazel-built `*_linux` binary). Tests are hermetic: never resolve the repo root — resolve inputs from runfiles via `testutil.Runfile` and stage docker build contexts with `testutil.WithBuildContext`.
 - Use `testutil.NewComposeStack()` with meaningful context (e.g., `"ext-storage-mysql"`)
 
 See [doc/howto/TESTING.md](doc/howto/TESTING.md) for full testing guide.

service/runway/server/BUILD.bazel

@@ -1,10 +1,7 @@
 load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
 
 exports_files(
-    [
-        "Dockerfile",
-        "docker-compose.yml",
-    ],
+    ["docker-compose.yml"],
     visibility = ["//visibility:public"],
 )
 
@@ -48,5 +45,17 @@ go_cross_binary(
     name = "runway_linux",
     platform = "@rules_go//go/toolchain:linux_amd64",
     target = ":runway",
-    visibility = ["//visibility:public"],
+)
+
+# Everything a Docker-based test needs to build the runway image from a staged
+# build context (see testutil.WithBuildContext). Test-only so the
+# cross-compiled binary cannot leak into production targets.
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        ":runway_linux",
+    ],
+    visibility = ["//test:__subpackages__"],
 )

service/stovepipe/server/BUILD.bazel

@@ -1,10 +1,5 @@
 load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
 
-exports_files(
-    ["Dockerfile"],
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = ["main.go"],
@@ -53,5 +48,17 @@ go_cross_binary(
     name = "stovepipe_linux",
     platform = "@rules_go//go/toolchain:linux_amd64",
     target = ":stovepipe",
-    visibility = ["//visibility:public"],
+)
+
+# Everything a Docker-based test needs to build the stovepipe image from a
+# staged build context (see testutil.WithBuildContext). Test-only so the
+# cross-compiled binary cannot leak into production targets.
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        ":stovepipe_linux",
+    ],
+    visibility = ["//test:__subpackages__"],
 )

service/submitqueue/gateway/server/BUILD.bazel

@@ -1,11 +1,7 @@
 load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library", "go_test")
 
 exports_files(
-    [
-        "Dockerfile",
-        "docker-compose.yml",
-        "queues.yaml",
-    ],
+    ["docker-compose.yml"],
     visibility = ["//visibility:public"],
 )
 
@@ -52,7 +48,20 @@ go_cross_binary(
     name = "gateway_linux",
     platform = "@rules_go//go/toolchain:linux_amd64",
     target = ":gateway",
-    visibility = ["//visibility:public"],
+)
+
+# Everything a Docker-based test needs to build the gateway image from a staged
+# build context (see testutil.WithBuildContext). Test-only so the
+# cross-compiled binary cannot leak into production targets.
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        "queues.yaml",
+        ":gateway_linux",
+    ],
+    visibility = ["//test:__subpackages__"],
 )
 
 go_test(

service/submitqueue/orchestrator/server/BUILD.bazel

@@ -1,10 +1,7 @@
 load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
 
 exports_files(
-    [
-        "Dockerfile",
-        "docker-compose.yml",
-    ],
+    ["docker-compose.yml"],
     visibility = ["//visibility:public"],
 )
 
@@ -82,5 +79,17 @@ go_cross_binary(
     name = "orchestrator_linux",
     platform = "@rules_go//go/toolchain:linux_amd64",
     target = ":orchestrator",
-    visibility = ["//visibility:public"],
+)
+
+# Everything a Docker-based test needs to build the orchestrator image from a
+# staged build context (see testutil.WithBuildContext). Test-only so the
+# cross-compiled binary cannot leak into production targets.
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        ":orchestrator_linux",
+    ],
+    visibility = ["//test:__subpackages__"],
 )

test/e2e/stovepipe/BUILD.bazel

@@ -9,8 +9,7 @@ go_test(
     data = [
         "//platform/extension/messagequeue/mysql/schema",
         "//service/stovepipe:docker-compose.yml",
-        "//service/stovepipe/server:Dockerfile",
-        "//service/stovepipe/server:stovepipe_linux",
+        "//service/stovepipe/server:docker_test_context",
         "//stovepipe/extension/storage/mysql/schema",
     ],
     tags = [

test/e2e/submitqueue/BUILD.bazel

@@ -9,14 +9,10 @@ go_test(
     data = [
         "//platform/extension/counter/mysql/schema",
         "//platform/extension/messagequeue/mysql/schema",
-        "//service/runway/server:Dockerfile",
-        "//service/runway/server:runway_linux",
+        "//service/runway/server:docker_test_context",
         "//service/submitqueue:docker-compose.yml",
-        "//service/submitqueue/gateway/server:Dockerfile",
-        "//service/submitqueue/gateway/server:gateway_linux",
-        "//service/submitqueue/gateway/server:queues.yaml",
-        "//service/submitqueue/orchestrator/server:Dockerfile",
-        "//service/submitqueue/orchestrator/server:orchestrator_linux",
+        "//service/submitqueue/gateway/server:docker_test_context",
+        "//service/submitqueue/orchestrator/server:docker_test_context",
         "//submitqueue/extension/storage/mysql/schema",
     ],
     tags = [

test/integration/stovepipe/BUILD.bazel

@@ -6,8 +6,7 @@ go_test(
     data = [
         "//platform/extension/messagequeue/mysql/schema",
         "//service/stovepipe:docker-compose.yml",
-        "//service/stovepipe/server:Dockerfile",
-        "//service/stovepipe/server:stovepipe_linux",
+        "//service/stovepipe/server:docker_test_context",
         "//stovepipe/extension/storage/mysql/schema",
     ],
     tags = [

test/integration/submitqueue/gateway/BUILD.bazel

@@ -6,10 +6,8 @@ go_test(
     data = [
         "//platform/extension/counter/mysql/schema",
         "//platform/extension/messagequeue/mysql/schema",
-        "//service/submitqueue/gateway/server:Dockerfile",
         "//service/submitqueue/gateway/server:docker-compose.yml",
-        "//service/submitqueue/gateway/server:gateway_linux",
-        "//service/submitqueue/gateway/server:queues.yaml",
+        "//service/submitqueue/gateway/server:docker_test_context",
         "//submitqueue/extension/storage/mysql/schema",
     ],
     tags = [

test/integration/submitqueue/orchestrator/BUILD.bazel

@@ -6,9 +6,8 @@ go_test(
     data = [
         "//platform/extension/counter/mysql/schema",
         "//platform/extension/messagequeue/mysql/schema",
-        "//service/submitqueue/orchestrator/server:Dockerfile",
         "//service/submitqueue/orchestrator/server:docker-compose.yml",
-        "//service/submitqueue/orchestrator/server:orchestrator_linux",
+        "//service/submitqueue/orchestrator/server:docker_test_context",
         "//submitqueue/extension/storage/mysql/schema",
     ],
     tags = [