fix: track inter-stage aliases in Dockerfile FROM rewriting

rewriteDockerfileFROMs was missing stage name tracking, which could
cause it to rewrite inter-stage FROM references (e.g. FROM builder)
to point at the local registry instead of the prior build stage.
Also skips ARG variable references (${...}) that can't be resolved.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hiroTamada

lib/builds/builder_agent/dockerfile_rewrite_test.go

@@ -139,6 +139,40 @@ COPY binary /`,
 RUN echo hello`,
 			expectedCount: 0,
 			expected: `FROM ` + registryURL + `/onkernel/nodejs22-base:0.1.1
+RUN echo hello`,
+		},
+		{
+			name: "inter-stage FROM reference is not rewritten",
+			dockerfile: `FROM onkernel/nodejs22-base:0.1.1 AS builder
+RUN npm install
+FROM builder
+COPY --from=builder /app /app`,
+			expectedCount: 1,
+			expected: `FROM ` + registryURL + `/onkernel/nodejs22-base:0.1.1 AS builder
+RUN npm install
+FROM builder
+COPY --from=builder /app /app`,
+		},
+		{
+			name: "inter-stage reference case insensitive",
+			dockerfile: `FROM onkernel/nodejs22-base:0.1.1 AS Builder
+RUN npm install
+FROM builder
+COPY --from=builder /app /app`,
+			expectedCount: 1,
+			expected: `FROM ` + registryURL + `/onkernel/nodejs22-base:0.1.1 AS Builder
+RUN npm install
+FROM builder
+COPY --from=builder /app /app`,
+		},
+		{
+			name: "variable reference FROM is not rewritten",
+			dockerfile: `ARG BASE_IMAGE=onkernel/nodejs22-base:0.1.1
+FROM ${BASE_IMAGE}
+RUN echo hello`,
+			expectedCount: 0,
+			expected: `ARG BASE_IMAGE=onkernel/nodejs22-base:0.1.1
+FROM ${BASE_IMAGE}
 RUN echo hello`,
 		},
 	}

lib/builds/builder_agent/main.go

@@ -937,6 +937,7 @@ func rewriteDockerfileFROMs(dockerfilePath, registryURL string, insecure bool, r
 
 	lines := strings.Split(string(content), "\n")
 	rewriteCount := 0
+	stageNames := make(map[string]bool)
 
 	for i, line := range lines {
 		trimmed := strings.TrimSpace(line)
@@ -971,6 +972,14 @@ func rewriteDockerfileFROMs(dockerfilePath, registryURL string, insecure bool, r
 
 		imageRef := parts[imageIdx]
 
+		// Record AS alias if present
+		for j := imageIdx + 1; j < len(parts)-1; j++ {
+			if strings.EqualFold(parts[j], "AS") {
+				stageNames[strings.ToLower(parts[j+1])] = true
+				break
+			}
+		}
+
 		// Skip if already referencing the local registry
 		if strings.HasPrefix(imageRef, registryURL+"/") {
 			continue
@@ -981,6 +990,16 @@ func rewriteDockerfileFROMs(dockerfilePath, registryURL string, insecure bool, r
 			continue
 		}
 
+		// Skip inter-stage references (e.g. FROM builder)
+		if stageNames[strings.ToLower(imageRef)] {
+			continue
+		}
+
+		// Skip variable references that can't be resolved
+		if strings.Contains(imageRef, "${") {
+			continue
+		}
+
 		// Normalize the image reference
 		// Docker Hub images can be referenced as:
 		// - "nginx" (library image)