fix: skip symlinked directories in build-image context copy (gastownhall#2232)

## Summary

filepath.Walk uses os.Lstat and does not follow symlinks, so symlinks to
directories have IsDir()=false and were incorrectly passed to copyFile,
which failed with "is a directory" when os.Open followed the link. Now
detect symlinks via ModeSymlink: skip dir symlinks, copy file symlink
content with the resolved mode.

Closes gastownhall#2231

## Testing

- [x] `make check` - I ran it and it fails on some unrelated code
- [ ] `make check-docs` if docs, navigation, or links changed: not
relevant
- [ ] `make test-integration` if runtime, controller, or workflow
behavior changed: not relevant

## Checklist

- [x] Linked an issue, or explained why one is not needed
- [x] Added or updated tests for behavior changes
- [ ] Updated docs for user-facing changes: not relevant
- [ ] Called out breaking changes or migration notes: not relevant

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Julian Knutsen <julianknutsen@users.noreply.github.com>

Author: 3 people

cmd/gc/cmd_build_image.go

@@ -109,6 +109,7 @@ func doBuildImage(args []string, tag, baseImage string, rigPaths []string, push,
 		BaseImage: baseImage,
 		Tag:       tag,
 		RigPaths:  rigs,
+		Stderr:    stderr,
 	}
 	if err := buildimage.AssembleContext(opts); err != nil {
 		fmt.Fprintf(stderr, "gc build-image: %v\n", err) //nolint:errcheck // best-effort stderr

cmd/gc/cmd_build_image_test.go

@@ -153,6 +153,49 @@ name = "test-city"
 	_ = os.RemoveAll(outputDir)
 }
 
+func TestBuildImageRoutesContextWarningsToStderr(t *testing.T) {
+	cityDir := t.TempDir()
+	targetDir := t.TempDir()
+
+	if err := os.MkdirAll(filepath.Join(cityDir, ".claude", "skills"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(`[workspace]
+name = "test-city"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(targetDir, "skill.md"), []byte("# skill"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(targetDir, filepath.Join(cityDir, ".claude", "skills", "core.gc-agents")); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doBuildImage(
+		[]string{cityDir},
+		"",
+		"gc-agent:latest",
+		nil,
+		false,
+		true,
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("doBuildImage returned %d; stderr: %s", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "skipping symlinked directory") {
+		t.Fatalf("stderr = %q, want skipped directory symlink diagnostic", stderr.String())
+	}
+
+	line := strings.TrimSpace(stdout.String())
+	parts := strings.SplitN(line, ": ", 2)
+	if len(parts) == 2 {
+		_ = os.RemoveAll(parts[1])
+	}
+}
+
 func TestBuildImageCLIRegistered(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	root := newRootCmd(&stdout, &stderr)

internal/buildimage/context.go

@@ -24,6 +24,8 @@ type Options struct {
 	Tag string
 	// RigPaths maps rig name → local repo path for baking rig content.
 	RigPaths map[string]string
+	// Stderr receives non-fatal diagnostics. Defaults to os.Stderr.
+	Stderr io.Writer
 }
 
 // Manifest records what was baked into the image for debugging.
@@ -73,21 +75,25 @@ func AssembleContext(opts Options) error {
 	if opts.BaseImage == "" {
 		opts.BaseImage = "gc-agent:latest"
 	}
+	stderr := opts.Stderr
+	if stderr == nil {
+		stderr = os.Stderr
+	}
 
 	wsDir := filepath.Join(opts.OutputDir, "workspace")
 	if err := os.MkdirAll(wsDir, 0o755); err != nil {
 		return fmt.Errorf("creating workspace dir: %w", err)
 	}
 
 	// Copy city directory contents into workspace, excluding runtime state.
-	if err := copyDirFiltered(opts.CityPath, wsDir); err != nil {
+	if err := copyDirFiltered(opts.CityPath, wsDir, stderr); err != nil {
 		return fmt.Errorf("copying city to workspace: %w", err)
 	}
 
 	// Copy rig paths into workspace.
 	for rigName, rigPath := range opts.RigPaths {
 		rigDst := filepath.Join(wsDir, rigName)
-		if err := copyDirFiltered(rigPath, rigDst); err != nil {
+		if err := copyDirFiltered(rigPath, rigDst, stderr); err != nil {
 			return fmt.Errorf("copying rig %q: %w", rigName, err)
 		}
 	}
@@ -118,7 +124,20 @@ func AssembleContext(opts Options) error {
 }
 
 // copyDirFiltered copies src directory to dst, skipping excluded paths.
-func copyDirFiltered(src, dst string) error {
+// File symlinks are dereferenced and copied with the resolved file's mode,
+// unless the resolved target is excluded. Directory symlinks are skipped with
+// a diagnostic written to stderr. Broken symlinks are skipped; other
+// resolution errors are returned.
+func copyDirFiltered(src, dst string, stderr io.Writer) error {
+	if stderr == nil {
+		stderr = os.Stderr
+	}
+	absSrc, err := filepath.Abs(src)
+	if err != nil {
+		return fmt.Errorf("resolving source path %q: %w", src, err)
+	}
+	src = absSrc
+
 	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
@@ -149,10 +168,52 @@ func copyDirFiltered(src, dst string) error {
 			return os.MkdirAll(target, info.Mode())
 		}
 
+		if info.Mode()&os.ModeSymlink != 0 {
+			resolvedPath, err := filepath.EvalSymlinks(path)
+			if err != nil {
+				if os.IsNotExist(err) {
+					return nil // broken symlink, skip
+				}
+				return fmt.Errorf("resolving symlink %q: %w", path, err)
+			}
+			resolved, err := os.Stat(resolvedPath)
+			if err != nil {
+				if os.IsNotExist(err) {
+					return nil // broken symlink, skip
+				}
+				return fmt.Errorf("stat resolved symlink %q -> %q: %w", path, resolvedPath, err)
+			}
+			if resolved.IsDir() {
+				fmt.Fprintf(stderr, "skipping symlinked directory %s -> %s in build context\n", path, resolvedPath) //nolint:errcheck // best-effort diagnostic
+				return nil
+			}
+			resolvedRel, err := filepath.Rel(src, resolvedPath)
+			if err != nil {
+				return fmt.Errorf("rel resolved symlink %q -> %q: %w", path, resolvedPath, err)
+			}
+			if excludedPath(resolvedRel) || excludedResolvedPath(resolvedRel) {
+				return nil
+			}
+			return copyFile(resolvedPath, target, resolved.Mode())
+		}
+
 		return copyFile(path, target, info.Mode())
 	})
 }
 
+func excludedResolvedPath(rel string) bool {
+	parts := strings.Split(filepath.ToSlash(filepath.Clean(rel)), "/")
+	for i, part := range parts {
+		if part != citylayout.RuntimeRoot || i == len(parts)-1 {
+			continue
+		}
+		if excludedPath(filepath.Join(parts[i:]...)) {
+			return true
+		}
+	}
+	return false
+}
+
 // copyFile copies a single file.
 func copyFile(src, dst string, mode os.FileMode) error {
 	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {