fix(ops): bake workspace-configs-templates into platform Docker image

Tenant machines were booting with no templates because the Dockerfile
only shipped the Go binary + migrations. The canvas showed "0 templates"
with an empty picker.

Changes:
- platform/Dockerfile: build context changed from ./platform to repo
  root so COPY can reach workspace-configs-templates/ alongside the
  Go source. COPY paths updated for platform/{go.mod,go.sum,*.go} and
  platform/migrations/.
- .github/workflows/publish-platform-image.yml: context: . (was
  ./platform), paths trigger now includes workspace-configs-templates/
  so template changes rebuild the image.

Phase A of the template-registry plan. Phase B adds a DB registry +
on-demand fetch for community templates (user pastes GitHub URL at
workspace creation time). The baked defaults always ship in the image
for zero-config tenant boot.

Verified: `docker build -f platform/Dockerfile -t test .` succeeds,
`docker run --rm test ls /workspace-configs-templates/` shows all 8
templates (autogen, claude-code-default, crewai, deepagents, gemini-cli,
hermes, langgraph, openclaw).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/publish-platform-image.yml

@@ -12,6 +12,7 @@ on:
       # Only rebuild when something platform-relevant changes — saves GHA
       # minutes on docs-only / canvas-only / MCP-only PRs.
       - 'platform/**'
+      - 'workspace-configs-templates/**'
       - '.github/workflows/publish-platform-image.yml'
   # Manual trigger for re-publishing a tag after a non-platform merge.
   workflow_dispatch:
@@ -129,7 +130,7 @@ jobs:
         # but Fly tenant machines are amd64. QEMU handles the emulation.
         uses: docker/build-push-action@v5
         with:
-          context: ./platform
+          context: .
           file: ./platform/Dockerfile
           platforms: linux/amd64
           push: true
@@ -150,7 +151,7 @@ jobs:
         if: always()
         uses: docker/build-push-action@v5
         with:
-          context: ./platform
+          context: .
           file: ./platform/Dockerfile
           platforms: linux/amd64
           push: true

platform/Dockerfile

@@ -1,8 +1,12 @@
+# Build context: repo root (not ./platform) so we can COPY both the Go
+# source and the workspace-configs-templates directory that lives beside it.
+# CI workflow sets `context: .` and `file: ./platform/Dockerfile`.
+
 FROM golang:1.25-alpine AS builder
 WORKDIR /app
-COPY go.mod go.sum ./
+COPY platform/go.mod platform/go.sum ./
 RUN go mod download
-COPY . .
+COPY platform/ .
 RUN CGO_ENABLED=0 GOOS=linux go build -o /platform ./cmd/server
 
 FROM alpine:3.20
@@ -10,6 +14,10 @@ FROM alpine:3.20
 # GitHub URLs (POST /workspaces/:id/plugins {"source": "github://..."}).
 RUN apk add --no-cache ca-certificates git tzdata
 COPY --from=builder /platform /platform
-COPY migrations /migrations
+COPY platform/migrations /migrations
+# Default templates baked into the image so tenants boot with a working
+# template picker. Phase B adds a registry + on-demand fetch for
+# community templates; these curated defaults always ship in the image.
+COPY workspace-configs-templates /workspace-configs-templates
 EXPOSE 8080
 CMD ["/platform"]