fix(execution): build the image in CI, and copy the package that broke it

[robertleifke]

The execution image has not been buildable since #69

src/executor.ts(15,34): error TS2307: Cannot find module '@numo/kms-signer'
ERROR: failed to build: failed to solve: ... exit code: 1

#69 moved the KMS signer into @numo/kms-signer, but services/execution/Dockerfile copies and builds only @numo/abis. Nothing was deployed with it, so the running venue is unaffected — but this is not only about shipping new work: execution-service could not be rebuilt for any reason, including a rollback.

The cause is narrow. A workspace package's main/types resolve to dist/, which is gitignored (.gitignore:5 **/dist/), so copied-but-unbuilt means "Cannot find module".

Why it reached main matters more than the fix

CI runs pnpm install + tsc at the workspace root, where every package resolves through the root node_modules regardless of what the Dockerfile does. The image only has what it COPYs and builds. Those are different claims and only one was checked, so green CI and an unbuildable image were entirely compatible.

That is the same "green means two different things" problem scripts/verify.sh exists to remove — it had simply never covered the image.

So:

• services-execution.yml now runs docker build
• verify.sh mirrors it, skipping with a note when docker is absent rather than failing — same shape as the terraform section, and for the same reason
• the Dockerfile comment now says to add the build step when a workspace dependency is added, and says CI will catch it if you forget

A future workspace dependency that isn't added to the Dockerfile now fails in CI instead of at deploy.

Swept the class

services/markets is Go and uses COPY . ., so it cannot have this bug. It is the only other Dockerfile in the repo.

Verification

The failing build above is real and reproduced locally. The verifying build of the fix stalled on registry metadata (10 minutes with no progress past load metadata for node:22-slim) and I killed it rather than wait it out — so CI running the new step is the proof this works, which is a reasonable place to put that proof given the step is the point of the PR.

Paths confirmed by hand: packages/kms-signer/package.json and tsconfig.json exist, its build is tsc -p tsconfig.json, outDir is dist, and main is ./dist/index.js.

If CI's docker build fails, this PR is wrong and should not be merged on my say-so.

Note

This is mine — #69 introduced it, and I wrote and recommended #69.

🤖 Generated with Claude Code