fix: rebuild k8s Dockerfile.sg_only with correct ccb-repo base image

Two k8s build tasks had broken Dockerfile.sg_only using minimal ubuntu:22.04
instead of ccb-repo-k8s-11602f08. This meant MCP runs had no Go compiler,
no k8s source, and no /repo_full backup — causing go build timeouts in the
verifier while baseline passed fine.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_build/k8s-noschedule-taint-feat-001/environment/Dockerfile.sg_only

@@ -1,27 +1,19 @@
 # k8s-noschedule-taint-feat-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM ubuntu:22.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-k8s-11602f08
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-# Mark sg_only mode so verifiers can skip local-path checks
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []

benchmarks/ccb_build/k8s-score-normalizer-refac-001/environment/Dockerfile.sg_only

@@ -1,27 +1,19 @@
 # k8s-score-normalizer-refac-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM ubuntu:22.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-k8s-11602f08
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-# Mark sg_only mode so verifiers can skip local-path checks
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []