Publish MOSAICO PR-Agent images to Eclipse registry

• Goal: Publish the existing MOSAICO PR-Agent image in Eclipse GitLab's registry for demonstrator consumption.
• Before: This deployment repository had no image-build pipeline and consumed Docker Hub's 0.41.0-mosaico_agent image.
• After: CI republishes that digest-pinned image for AMD64 and ARM64. Same-project MRs produce mr-<iid>-<full-sha> previews; only default-branch pushes publish the stable 0.41.0-mosaico_agent tag. Deployment defaults select Eclipse.
• The Change: A one-line Dockerfile, Eclipse's pinned shared BuildKit template, and focused deployment/documentation updates. GitLab job credentials provide registry access; no permanent CI secrets or copied application source.
• Confidence: The final preview preserves the upstream runtime configuration and all 11 filesystem layers. Actual registration, discovery, routed delegation and model-backed container execution provide direct integration evidence. This supports packaging compatibility; model correctness has the limitations below.
• Regression risks: Registry/runner availability, publication rules and coordinated upgrades. The stable tag is created only after merge and successful default-branch publication; that path cannot be executed before merge. Upstream PR 4148 remains draft until the stable image exists. Existing root execution, scanner findings and response-quality limitations remain. Neither request is merged automatically.

Validation:

• Actual containers run against the pinned upstream image and published Eclipse preview. The isolated demonstrator graph uses the real repository, pgvector, Ollama embeddings, registrar, Langfuse and backing services. Registration persisted; semantic and MCP discovery returned PR-Agent; a separate client followed its stored card and advertised A2A endpoint.
• Real model-backed health and all four A2A skills (review, improve, describe, ask) completed using the existing MOSAICO OpenRouter configuration. Reference-agent routing exercised search, discovery and delegation; its trace persisted in Langfuse with MCP, endpoint, PR-Agent and model spans.
• Existing output limits are disclosed: review responses in both final architecture runs named TypeError instead of ZeroDivisionError, while ask/improve identified it correctly. describe returns its body without the generated title; inspection of the original pinned image confirms that capture behavior predates this change. These results do not establish perfect model accuracy or full title-contract compliance.
• Source CI: 13,266 passed / 33 skipped on each of Python 3.12, 3.13 and 3.14, and in the Docker test job; packaging checks 3 passed. Focused local MOSAICO suite: 280 passed / 1 optional live-LLM test skipped. Pre-commit, shell syntax and whitespace checks passed. Test-code net LOC is 0. These source tests are separate from selected-image provenance and live container evidence.
• Final Eclipse pipeline 172987: build, secret detection and KICS completed successfully after retrying external runner-helper failures. Secret detection found 0 issues. KICS reported 8 findings: 1 Critical missing explicit Dockerfile USER, 6 Medium on unchanged Compose configuration, and 1 Info missing image HEALTHCHECK. The thin image inherits the upstream runtime user; changing it would change behavior. Compose supplies the exercised model-backed healthcheck. No findings were suppressed.

Final preview: registry.eclipse.org/eclipse-research-labs/mosaico-project/qodo-pr-agent:mr-1-038f0b3fe8be36d522c503f2f9125ee048f80df6

Index digest: sha256:08a4da94cbb2901a2921d92ff423cb510680f545e00d001137c8e70e47c84f18.

Final published-image execution matrix:

Execution	Card + real model health	review / improve / describe / ask	Registration + semantic/MCP discovery	Returned endpoint reachable
ARM64, native aarch64	Passed	All tasks completed; quality limits above	Passed	Host and client container
AMD64, emulated x86_64	Passed	All tasks completed; quality limits above	Passed	Host and client container

All eight direct-skill traces persisted, one for each skill on each architecture. Cleanup verified zero test-owned containers, networks or volumes remain; private generated configuration was removed and retained evidence sanitized. Existing user resources were preserved.

The final ARM64 reference-agent request completed through actual repository discovery/delegation; Langfuse persisted trace a83da66cd95c4a8b9c21979407f6d4b2 with 52 observations. Test deployment explicitly configured reachable advertised host/port values; the shipped overlay was unchanged apart from its preview-image override and isolated resource/port names. The exact checked-in Dockerfile also built and booted Python on both platforms. This does not cover the public demonstrator UI, Keycloak login or production deployment.

File walkthrough, smallest to largest (excluding tests):

• Dockerfile: one digest-pinned upstream FROM preserves the selected application release.
• docker-compose.pr-agent.yml: changes only the image location, preserving service wiring.
• .gitlab-ci.yml: pins the shared Eclipse template, retains its applicable scans, builds both architectures and guards preview/stable tag publication.
• README.md: updates quick starts and documents provenance, ownership, first stable publication, previews and upgrades.