perf(harbor): pre-bake claude-code into the main image

vero/src/vero/harbor/build/templates/Dockerfile.main.j2

@@ -17,4 +17,13 @@ COPY agent-seed /opt/agent-seed
 COPY main/seed.sh /opt/seed.sh
 RUN chmod +x /opt/seed.sh && useradd -m -u 1001 agent
 
+# Pre-bake the claude-code CLI for the de-privileged agent user. Harbor's
+# per-trial agent setup re-runs the same bootstrap as that user; with this
+# layer it completes in ~250s instead of ~625s (measured 2026-07-03), inside
+# harbor's default 360s agent-setup budget, on networks where the full
+# download would blow it. A stale image (newer claude-code release) simply
+# re-downloads, degrading gracefully to the un-baked behavior; an offline
+# compile skips the layer without failing the build.
+RUN su - agent -c "curl -fsSL https://downloads.claude.ai/claude-code-releases/bootstrap.sh | bash -s --" || true
+
 WORKDIR /work/agent

vero/tests/test_harbor_build.py

@@ -167,3 +167,14 @@ def test_seed_documents_advisory_read_only(built):
     seed = (built / "environment/main/seed.sh").read_text()
     assert "ADVISORY ONLY" in seed
     assert "sidecar-side" in seed
+
+
+def test_main_dockerfile_prebakes_claude_code(built):
+    # The main image pre-installs claude-code for the agent user so harbor's
+    # per-trial re-run of the bootstrap is fast (~250s vs ~625s measured) and
+    # fits the default agent-setup budget. `|| true` keeps offline compiles
+    # working.
+    text = (built / "environment" / "Dockerfile").read_text()
+    assert "bootstrap.sh" in text
+    assert 'su - agent -c' in text
+    assert "|| true" in text