fix: unblock release desktop and universal builds (#1522)

Dockerfile

@@ -14,25 +14,59 @@
 # Run:
 #   docker run -p 38429:38429 -v kandev-data:/data ghcr.io/kdlbs/kandev:latest
 
+FROM debian:bookworm-slim AS apt-keys
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg && \
+    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+        | gpg --dearmor -o /nodesource.gpg && \
+    curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
+        | gpg --dearmor -o /microsoft.gpg && \
+    rm -rf /var/lib/apt/lists/*
+
 FROM debian:bookworm-slim
 
+ARG NODE_MAJOR=24
+
+COPY --from=apt-keys /nodesource.gpg /usr/share/keyrings/nodesource.gpg
+COPY --from=apt-keys /microsoft.gpg /usr/share/keyrings/microsoft.gpg
+
 # Install runtime dependencies. gh is included because the GitHub integration
 # (PR review, webhooks) shells out to it for auth fallback when GITHUB_TOKEN
-# is not set. Azure CLI + azure-devops extension support agentctl Azure Repos
-# PR creation (az repos pr create). apprise is installed via pipx for
-# notification fan-out.
+# is not set. Node/npm support agent CLI installs and the universal image's
+# pnpm layer. Azure CLI + azure-devops extension support agentctl Azure Repos PR
+# creation (az repos pr create). apprise is installed via pipx for notification
+# fan-out.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        git \
-        gh \
+        apt-transport-https \
         ca-certificates \
         curl \
+        git \
+        gh \
         gosu \
         tini \
         python3 \
         python3-venv \
         pipx && \
-    curl -sL https://aka.ms/InstallAzureCLIDeb | bash && \
+    echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \
+        > /etc/apt/sources.list.d/nodesource.list && \
+    arch="$(dpkg --print-architecture)" && \
+    printf "%s\n" \
+        "Types: deb" \
+        "URIs: https://packages.microsoft.com/repos/azure-cli/" \
+        "Suites: bookworm" \
+        "Components: main" \
+        "Architectures: $arch" \
+        "Signed-by: /usr/share/keyrings/microsoft.gpg" \
+        > /etc/apt/sources.list.d/azure-cli.sources && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends nodejs azure-cli && \
+    rm -f \
+        /etc/apt/sources.list.d/nodesource.list \
+        /etc/apt/sources.list.d/azure-cli.sources \
+        /usr/share/keyrings/nodesource.gpg \
+        /usr/share/keyrings/microsoft.gpg && \
     rm -rf /var/lib/apt/lists/* && \
     PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install apprise