docs+build-images: document catatonit as a reproducible-build dependency

[barakeinav1]

Follow-up to #4128 — the docs/preflight side (no workflow files).

repro-env requires catatonit (its podman container entrypoint), but the reproducible-build prerequisite lists never mentioned it — nor skopeo (required unconditionally). So an operator reproducing the node image to verify a manifest digest before voting hits the opaque statfs /usr/bin/catatonit error the CI outage surfaced. Also hardens build-images.sh's preflight to check catatonit and cover --node-gcp (which reaches repro-env build but was skipping the check).

Docs-only + one preflight guard; no behavior change to successful builds (a missing dep now fails fast with Missing dependency: catatonit instead of podman's opaque error).

Fixes #4129

[claude]

PR title type suggestion: This PR changes both build system files and documentation. The conventional commit type should be a single, standard type. Since it modifies deployment/build-images.sh, the type should be build: instead.

Suggested title: build: document catatonit as a reproducible-build dependency

[Copilot]

Pull request overview

Updates operator-facing documentation and build-image preflight checks to explicitly include catatonit (required by repro-env/podman) and skopeo in reproducible-build prerequisites, preventing opaque runtime failures when dependencies are missing.

Changes:

• Document catatonit and podman as prerequisites for reproducible node/launcher image builds (and add skopeo to the common prerequisite list).
• Harden deployment/build-images.sh preflight to require catatonit and to include --node-gcp in the repro-env dependency gate.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
docs/running-an-mpc-node-in-tdx-external-guide.md	Adds missing reproducible-build prerequisites (podman, catatonit) for node and launcher verification steps.
docs/reproducible-builds.md	Updates prerequisite lists to include skopeo and catatonit, and clarifies node/launcher applicability.
deployment/build-images.sh	Extends preflight dependency checks to include catatonit and to cover --node-gcp.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[claude]

Pull request overview

Follow-up to #4128 (docs/preflight side only). repro-env shells out to podman, which bind-mounts catatonit as the container init, but none of the operator-facing prerequisite lists mentioned it — so an operator rebuilding the node image to verify the manifest digest they vote on hits podman's opaque statfs /usr/bin/catatonit. This PR adds catatonit (plus the previously missing skopeo/podman) to both prerequisite lists, and hardens build-images.sh's preflight so it checks catatonit and also fires for --node-gcp, which reaches repro-env build at build-images.sh:158 but was skipping the gate.

The substance is correct and matches the acceptance criteria in #4129. My findings are drift the PR leaves behind in the same files it audits.

Changes:

• build-images.sh preflight: add catatonit to require_cmds, extend the gate to USE_NODE_GCP
• docs/reproducible-builds.md: add skopeo to common reqs, add catatonit, retitle the node section to cover the launcher image
• docs/running-an-mpc-node-in-tdx-external-guide.md: add podman + catatonit to both operator verification walkthroughs

Reviewed changes

Per-file summary

File	Description
deployment/build-images.sh	require_cmds repro-env podman catatonit; gate widened to include USE_NODE_GCP
docs/reproducible-builds.md	skopeo added to common prerequisites; catatonit added; "node" heading now reads "node or launcher"
docs/running-an-mpc-node-in-tdx-external-guide.md	podman and catatonit added to the node (:1852) and launcher (:1958) build prerequisites

Findings

Blocking (must fix before merge):

• deployment/build-images.sh:5 — the file's own header comment is now the last stale copy of the list this PR fixes everywhere else: # Extra requirements if using --node or --rust-launcher: repro-env, podman omits both catatonit and --node-gcp. Per the repo's documentation-alignment rule this is the same defect the PR exists to close, one line above the code being changed:

  # Extra requirements if using --node, --node-gcp or --rust-launcher: repro-env, podman, catatonit

Non-blocking (nits, follow-ups, suggestions):

• deployment/build-images.sh:65 — with --node-gcp added, the guard is now unconditionally true: lines 44–48 set all three flags when none is passed, so at least one is always true (even for a bare --push). It is also semantically redundant — all three build paths run repro-env build (:149, :188). Dropping the conditional makes the preflight unconditional and removes the exact footgun this PR is fixing (a new image flag added without updating the gate):

  require_cmds docker git find touch skopeo repro-env podman catatonit

• deployment/build-images.sh:66 — command -v catatonit can false-negative on distros that ship the binary off PATH (e.g. podman packages placing it at /usr/libexec/podman/catatonit, one of the paths podman itself probes for init_path). There, podman works but the script hard-dies. Consider accepting either location, e.g. command -v catatonit >/dev/null || [[ -x /usr/libexec/podman/catatonit ]], before failing.
• deployment/build-images.sh:38 — the usage string in the arg-parse error path is missing --node-gcp (it disagrees with the usage comment at :9); same "forgot the gcp flag" class as the bug fixed here.
• docs/reproducible-builds.md:13 — while auditing this list: jq is listed as a common requirement but nothing in the build path uses it (require_cmds at :63 doesn't check it, and there is no jq invocation under deployment/). Worth dropping so the list stays trustworthy after this cleanup.
• docs/reproducible-builds.md:10,17 — after the retitle, the "Common requirements (for both node and launcher Docker images)" / "Additional requirements for building the node or launcher image" split covers the same set, so the two-section structure no longer carries information; merging them would read better. Relatedly, --node-gcp appears nowhere in this doc, and :32 "Build both node and launcher images (default behavior)" is inaccurate — the default builds three images including mpc-node-gcp (:44-48).
• Missing sibling prerequisite (follow-up, outside this PR's stated scope): .github/workflows/ci.yml:52 sets kernel.apparmor_restrict_unprivileged_userns=0 because repro-env/podman need it on Ubuntu 24.04, and that requirement is documented nowhere under docs/. An external operator on Ubuntu 24.04 following running-an-mpc-node-in-tdx-external-guide.md hits an opaque podman failure for the same reason the catatonit one was opaque.

⚠️ Issues found