fix: generate Dockerfile.sg_only for 13 new tasks, fix eclipse-temurin tag

- Fix generate_sgonly_dockerfiles.py to discover tasks from on-disk
  benchmarks/ directories instead of relying solely on TASK_CATALOG.md
- Remove stale rsync install from build-requiring template (wrapper
  already uses cp -a)
- Generate 10 missing Dockerfile.sg_only (9 write-only, 1 build-req)
- Regenerate 3 hand-crafted sg_only files with standard template
  (adds git init, /tmp/.sg_only_mode marker)
- Fix eclipse-temurin:21-jdk-bookworm -> eclipse-temurin:21-jdk in
  docgen-inline-002 and test-coverage-gap-002 Dockerfiles
- All 13 new tasks validated: Docker build + no-agent smoke pass

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_document/docgen-changelog-001/environment/Dockerfile.sg_only

@@ -1,15 +1,27 @@
-FROM ubuntu:22.04
+# docgen-changelog-001 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
 
-RUN apt-get update && apt-get install -y \
+FROM golang:1.23-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
     python3 \
-    python3-pip \
     curl \
-    unzip \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir pytest
-
-RUN mkdir -p /workspace /logs/verifier /app
 WORKDIR /workspace
 
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
 ENTRYPOINT []

benchmarks/ccb_document/docgen-changelog-002/environment/Dockerfile.sg_only

@@ -0,0 +1,27 @@
+# docgen-changelog-002 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+
+FROM golang:1.23-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    python3 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
+ENTRYPOINT []

benchmarks/ccb_document/docgen-inline-001/environment/Dockerfile.sg_only

@@ -1,15 +1,27 @@
-FROM ubuntu:22.04
+# docgen-inline-001 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
 
-RUN apt-get update && apt-get install -y \
+FROM python:3.11-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
     python3 \
-    python3-pip \
     curl \
-    unzip \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir pytest
-
-RUN mkdir -p /workspace /logs/verifier /app
 WORKDIR /workspace
 
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
 ENTRYPOINT []

benchmarks/ccb_document/docgen-inline-002/environment/Dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:21-jdk-bookworm
+FROM eclipse-temurin:21-jdk
 
 WORKDIR /workspace
 

benchmarks/ccb_document/docgen-inline-002/environment/Dockerfile.sg_only

@@ -1,15 +1,27 @@
-FROM ubuntu:22.04
+# docgen-inline-002 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
 
-RUN apt-get update && apt-get install -y \
+FROM eclipse-temurin:17-jdk
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
     python3 \
-    python3-pip \
     curl \
-    unzip \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir pytest
-
-RUN mkdir -p /workspace /logs/verifier /app
 WORKDIR /workspace
 
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
 ENTRYPOINT []

benchmarks/ccb_document/docgen-onboard-001/environment/Dockerfile.sg_only

@@ -0,0 +1,27 @@
+# docgen-onboard-001 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+
+FROM golang:1.23-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    python3 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
+ENTRYPOINT []

benchmarks/ccb_document/docgen-runbook-001/environment/Dockerfile.sg_only

@@ -0,0 +1,27 @@
+# docgen-runbook-001 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+
+FROM golang:1.23-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    python3 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
+ENTRYPOINT []

benchmarks/ccb_document/docgen-runbook-002/environment/Dockerfile.sg_only

@@ -0,0 +1,27 @@
+# docgen-runbook-002 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    python3 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
+ENTRYPOINT []

benchmarks/ccb_test/test-coverage-gap-001/environment/Dockerfile.sg_only

@@ -0,0 +1,27 @@
+# test-coverage-gap-001 — sg_only_env variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    python3 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Empty git repo so agent can commit work
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode so verifiers can skip local-path checks
+RUN touch /tmp/.sg_only_mode
+
+ENTRYPOINT []

benchmarks/ccb_test/test-coverage-gap-002/environment/Dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:21-jdk-bookworm
+FROM eclipse-temurin:21-jdk
 
 WORKDIR /workspace