fix(docker): stabilize pre-commit docker check and totp pam wording

Co-authored-by: Peter Ryszkiewicz <pRizz@users.noreply.github.com>

Author: cursoragent

justfile

@@ -216,13 +216,17 @@ build-docker-no-cache:
 check-docker:
     @echo "Checking Dockerfile syntax and build stages..."
     @cp packages/core/src/docker/Dockerfile Dockerfile.build
-    DOCKER_BUILDKIT=1 docker build \
-        -f Dockerfile.build \
-        --target opencode-build \
-        -t opencode-cloud-sandbox:check \
-        .
+    @builder=opencode-cloud-precommit; \
+        if ! docker buildx inspect "$builder" >/dev/null 2>&1; then \
+            docker buildx create --name "$builder" --driver docker-container >/dev/null; \
+        fi; \
+        docker buildx inspect "$builder" --bootstrap >/dev/null; \
+        docker buildx build \
+            --builder "$builder" \
+            -f Dockerfile.build \
+            --target runtime-config-check \
+            .
     @rm -f Dockerfile.build
-    @docker rmi opencode-cloud-sandbox:check 2>/dev/null || true
     @echo "✓ Dockerfile check passed"
 
 # Run all tests (fast)

packages/core/src/docker/Dockerfile

@@ -749,6 +749,34 @@ RUN set -eux; \
     sudo chmod 4755 /usr/local/bin/opencode-broker; \
     sudo rm -rf /tmp/opencode-dist /tmp/opencode-broker-bin
 
+# -----------------------------------------------------------------------------
+# Stage 3: Runtime Config Check
+# -----------------------------------------------------------------------------
+# Lightweight validation stage for local pre-commit Docker checks.
+# Verifies runtime config assets and COPY paths without rebuilding heavy Rust
+# and JS artifacts in later stages.
+FROM base AS runtime-config-check
+
+USER root
+COPY --chown=root:root --chmod=0644 packages/core/src/docker/files/pam/opencode /etc/pam.d/opencode
+COPY --chown=root:root --chmod=0644 packages/core/src/docker/files/opencode-broker.service /etc/systemd/system/opencode-broker.service
+COPY --chown=root:root --chmod=0644 packages/core/src/docker/files/opencode.service /etc/systemd/system/opencode.service
+RUN install -d -o opencoder -g opencoder -m 0750 /home/opencoder/.config/opencode
+COPY --chown=opencoder:opencoder --chmod=0640 packages/core/src/docker/files/opencode.jsonc /home/opencoder/.config/opencode/opencode.jsonc
+RUN install -d -m 0755 /etc/opencode-cloud
+COPY --chown=root:root --chmod=0644 packages/core/src/docker/files/opencode.jsonc /etc/opencode-cloud/opencode.jsonc.default
+COPY --chown=root:root --chmod=0755 packages/core/src/docker/files/entrypoint.sh /usr/local/bin/entrypoint.sh
+COPY --chown=root:root --chmod=0700 packages/core/src/docker/files/opencode-cloud-bootstrap.sh /usr/local/bin/opencode-cloud-bootstrap
+COPY --chown=root:root --chmod=0755 packages/core/src/docker/files/healthcheck.sh /usr/local/bin/healthcheck.sh
+RUN test -f /etc/pam.d/opencode \
+    && test -f /etc/systemd/system/opencode-broker.service \
+    && test -f /etc/systemd/system/opencode.service \
+    && test -f /home/opencoder/.config/opencode/opencode.jsonc \
+    && test -f /etc/opencode-cloud/opencode.jsonc.default \
+    && test -x /usr/local/bin/entrypoint.sh \
+    && test -x /usr/local/bin/opencode-cloud-bootstrap \
+    && test -x /usr/local/bin/healthcheck.sh
+
 # -----------------------------------------------------------------------------
 # Stage 3: Runtime
 # -----------------------------------------------------------------------------

packages/core/src/docker/files/pam/opencode

@@ -5,5 +5,5 @@
 auth required pam_unix.so
 account required pam_unix.so
 
-# Optional: Enable TOTP 2FA (uncomment when pam_google_authenticator is installed)
+# Optional: Enable TOTP authentication (uncomment when pam_google_authenticator is installed)
 # auth required pam_google_authenticator.so