Add toolchains to the orb image

Edit image/Dockerfile to put a compiler or tool in every orb. Setup that belongs to one repo goes in that repo’s .agents/setup instead.

Add RUN lines
Put them between USER root and USER user:
```
RUN apt-get update \
 && apt-get install -y --no-install-recommends golang-go \
 && rm -rf /var/lib/apt/lists/*
```
Pin versions where you can (pkg=<version>), because a rebuild with unpinned packages can give a different image.

Test the image locally (optional)

docker build --platform linux/amd64 -t cf-orbs-orb:dev image/
docker run --rm cf-orbs-orb:dev bash -lc 'ps -o args= -p 1; id -u; amp --version'

You should see /usr/bin/tini -s -- sleep infinity, 1000, and an amp version.

Deploy
```
npx cf-orbs deploy
```
The first image push is about 1.8 GB. deploy retries registry timeouts and Unauthorized answers up to 3 times. If it still fails, run cf-orbs deploy again: the registry keeps the layers it already received.
Clear the snapshot caches
Amp caches one project snapshot for each provider for 72 hours. After an image or setup change, new threads can still start from a disk made with the old image. To avoid that, clear both caches:
1. In Amp, delete the cached snapshot in Orb Settings → Snapshots, or run amp projects snapshots delete <owner/repo> --resource <size>.
2. In cf-orbs, run:
```
npx cf-orbs snapshots forget --all-project
```
Do the same after a change to a repo’s .agents/setup.

Keep the rules in Orb image: user user, sudo, the tini entrypoint, and the digest pin in FROM. cf-orbs doctor fails if a FROM has no digest.

Commit image/ after each change. See Back up and restore.