fix: use sg-evals mirrors in baseline Dockerfiles for new ccb_fix tasks

git fetch --depth 1 origin <sha> fails on GitHub for arbitrary commits.
Clone from sg-evals mirrors instead (single orphan commit, --depth 1 works).
Also fix workspace permission for clone-as-claude pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_fix/envoy-dfp-host-leak-fix-001/environment/Dockerfile

@@ -1,7 +1,5 @@
 FROM ubuntu:22.04
 
-WORKDIR /workspace
-
 # Install dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git curl ca-certificates python3 && \
@@ -12,15 +10,14 @@ RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \
     apt-get install -y --no-install-recommends nodejs && \
     rm -rf /var/lib/apt/lists/*
 
-# Create claude user before cloning (clone-as-claude pattern)
+# Create claude user and workspace (clone-as-claude pattern)
 RUN adduser --disabled-password --gecos '' claude 2>/dev/null || true
+RUN mkdir -p /workspace && chown claude:claude /workspace
 
 # Clone envoy at pre-fix commit as claude user
 USER claude
-RUN git clone --depth 1 https://github.com/envoyproxy/envoy.git /workspace && \
-    cd /workspace && \
-    git fetch --depth 1 origin 5160151e14837c6f352b9d0b3a9f55119a9317e8 && \
-    git checkout FETCH_HEAD
+RUN git clone --depth 1 https://github.com/sg-evals/envoy--5160151e.git /workspace
 USER root
 
+WORKDIR /workspace
 ENTRYPOINT []

benchmarks/ccb_fix/envoy-udp-proxy-cds-fix-001/environment/Dockerfile

@@ -1,7 +1,5 @@
 FROM ubuntu:22.04
 
-WORKDIR /workspace
-
 # Install dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git curl ca-certificates python3 && \
@@ -12,15 +10,14 @@ RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \
     apt-get install -y --no-install-recommends nodejs && \
     rm -rf /var/lib/apt/lists/*
 
-# Create claude user before cloning (clone-as-claude pattern)
+# Create claude user and workspace (clone-as-claude pattern)
 RUN adduser --disabled-password --gecos '' claude 2>/dev/null || true
+RUN mkdir -p /workspace && chown claude:claude /workspace
 
 # Clone envoy at pre-fix commit as claude user
 USER claude
-RUN git clone --depth 1 https://github.com/envoyproxy/envoy.git /workspace && \
-    cd /workspace && \
-    git fetch --depth 1 origin 1ae957c1f92b8e0b0322ab702c67612aa618d214 && \
-    git checkout FETCH_HEAD
+RUN git clone --depth 1 https://github.com/sg-evals/envoy--1ae957c1.git /workspace
 USER root
 
+WORKDIR /workspace
 ENTRYPOINT []

benchmarks/ccb_fix/terraform-plan-null-unknown-fix-001/environment/Dockerfile

@@ -1,7 +1,5 @@
 FROM ubuntu:22.04
 
-WORKDIR /workspace
-
 # Install dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git curl ca-certificates python3 && \
@@ -12,15 +10,14 @@ RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \
     apt-get install -y --no-install-recommends nodejs && \
     rm -rf /var/lib/apt/lists/*
 
-# Create claude user before cloning (clone-as-claude pattern)
+# Create claude user and workspace (clone-as-claude pattern)
 RUN adduser --disabled-password --gecos '' claude 2>/dev/null || true
+RUN mkdir -p /workspace && chown claude:claude /workspace
 
 # Clone terraform at pre-fix commit as claude user
 USER claude
-RUN git clone --depth 1 https://github.com/hashicorp/terraform.git /workspace && \
-    cd /workspace && \
-    git fetch --depth 1 origin abd6b9ef1ba5e98ed273f59f667d3b9f2077a87b && \
-    git checkout FETCH_HEAD
+RUN git clone --depth 1 https://github.com/sg-evals/terraform--abd6b9ef.git /workspace
 USER root
 
+WORKDIR /workspace
 ENTRYPOINT []