infra(docker): upgrade all images to Ubuntu 24.04 + CUDA 12.9

Align all 4 Docker images with local dev environment:
- ci-builder: CUDA 12.4.1/Ubuntu 22.04 → 12.9.1/Ubuntu 24.04
- ci-builder-cpu: Debian bookworm → Ubuntu 24.04 (+ explicit rustup)
- foxhunt-runtime: Debian bookworm → Ubuntu 24.04
- foxhunt-training-runtime: CUDA 12.6.3 → 12.9.1, nvrtc 12-6 → 12-9

All images now have glibc 2.39, matching the local build machine.
Binaries compiled locally or in CI will run in any of these containers
without GLIBC_2.3x version mismatch errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/docker/Dockerfile.ci-builder

@@ -1,10 +1,10 @@
 # Pre-baked CI builder image for Foxhunt
-# Contains: CUDA 12.4, Rust 1.89, protoc, sccache, git, OpenSSL, lld, make
+# Contains: CUDA 12.9, Rust 1.89, protoc, sccache, git, OpenSSL, lld, make
 # Build: docker build -f infra/docker/Dockerfile.ci-builder -t foxhunt-ci-builder .
 # Push:  docker tag foxhunt-ci-builder git.fxhnt.ai:5050/root/foxhunt/ci-builder:latest
 #        docker push git.fxhnt.ai:5050/root/foxhunt/ci-builder:latest
 
-FROM nvidia/cuda:12.4.1-cudnn-devel-ubuntu22.04
+FROM nvidia/cuda:12.9.1-cudnn-devel-ubuntu24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -39,7 +39,7 @@ RUN curl -fsSL https://github.com/protocolbuffers/protobuf/releases/download/v28
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.89.0
 ENV PATH="/root/.cargo/bin:${PATH}"
 
-# sccache for S3-backed build caching
+# sccache for local PVC-backed build caching
 RUN curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
     | tar xz -C /usr/local/bin --strip-components=1 sccache-v0.10.0-x86_64-unknown-linux-musl/sccache \
     && chmod +x /usr/local/bin/sccache

infra/docker/Dockerfile.ci-builder-cpu

@@ -1,11 +1,12 @@
 # CUDA-free CI builder image for Foxhunt service compilation
 # ~2-3GB vs ~8GB for the CUDA devel variant (Dockerfile.ci-builder)
 # Contains: Rust 1.89, protoc, sccache, rclone, git, OpenSSL, clang, mold, lld, make
+# Base: Ubuntu 24.04 (glibc 2.39) — matches local dev and training runtime
 # Build: docker build -f infra/docker/Dockerfile.ci-builder-cpu -t foxhunt-ci-builder-cpu .
 # Push:  docker tag foxhunt-ci-builder-cpu gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ci-builder-cpu:latest
 #        docker push gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ci-builder-cpu:latest
 
-FROM rust:1.89-slim-bookworm
+FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -25,6 +26,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     unzip \
     && rm -rf /var/lib/apt/lists/*
 
+# Install Rust 1.89 stable (no longer inheriting from rust: base image)
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.89.0
+ENV PATH="/root/.cargo/bin:${PATH}"
+
 # mold linker — 2-5x faster than lld for final link step on large Rust binaries
 RUN curl -fsSL https://github.com/rui314/mold/releases/download/v2.35.1/mold-2.35.1-x86_64-linux.tar.gz \
     | tar xz -C /usr/local --strip-components=1 \
@@ -36,7 +41,7 @@ RUN curl -fsSL https://github.com/protocolbuffers/protobuf/releases/download/v28
     && rm /tmp/protoc.zip \
     && chmod +x /usr/local/bin/protoc
 
-# sccache for S3-backed build caching
+# sccache for local PVC-backed build caching
 RUN curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
     | tar xz -C /usr/local/bin --strip-components=1 sccache-v0.10.0-x86_64-unknown-linux-musl/sccache \
     && chmod +x /usr/local/bin/sccache

infra/docker/Dockerfile.foxhunt-runtime

@@ -1,13 +1,14 @@
 # Generic runtime base image for all Foxhunt service pods
 # Contains: rclone (S3 binary fetch), grpc_health_probe (K8s health checks)
+# Base: Ubuntu 24.04 (glibc 2.39) — matches compile environment
 # Binaries are fetched by initContainer at pod startup, not baked into this image.
 # Rebuild: only when system deps change (libssl, rclone, grpc_health_probe)
 
-FROM debian:bookworm-slim
+FROM ubuntu:24.04
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
-    libssl3 \
+    libssl3t64 \
     curl \
     jq \
     unzip \

infra/docker/Dockerfile.foxhunt-training-runtime

@@ -1,9 +1,9 @@
 # Generic GPU runtime base image for Foxhunt training pods
-# Contains: CUDA 12.4 + cuDNN + NVRTC + rclone
+# Contains: CUDA 12.9 + cuDNN + NVRTC + rclone
 # Binaries are fetched by initContainer at pod startup, not baked into this image.
 # Rebuild: only on CUDA version bump
 
-FROM nvidia/cuda:12.6.3-cudnn-runtime-ubuntu24.04
+FROM nvidia/cuda:12.9.1-cudnn-runtime-ubuntu24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -12,7 +12,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libssl3t64 \
     curl \
     unzip \
-    cuda-nvrtc-12-6 \
+    cuda-nvrtc-12-9 \
     && curl -fsSL https://downloads.rclone.org/v1.69.1/rclone-v1.69.1-linux-amd64.zip -o /tmp/rclone.zip \
     && unzip -j /tmp/rclone.zip '*/rclone' -d /usr/local/bin/ \
     && rm /tmp/rclone.zip \