Address PR review nits: supervisord-shim is an HTTP producer (stamped at
ingest), not an in-process one; use cdpmonitor as the real example. Clarify
the hazard is a non-zero, non-wall-clock Ts since publishLocked already
defaults a zero Ts to wall-clock.

Co-authored-by: Cursor <cursoragent@cursor.com>

### Overview

`system_oom_kill` events were stamped with the kmsg envelope timestamp,
which is `CLOCK_MONOTONIC`-derived. That clock freezes while a unikraft
VM is suspended (scale-to-zero), so on any VM that had standbyed the OOM
timestamps skewed backward by the accumulated suspended duration —
sometimes by hours.

- `sysmon` kmsg reader now stamps each record with wall-clock read time
(`time.Now()`) instead of the envelope timestamp. We only ever read live
records (the source seeks to end first), so read time is an accurate
event time.
- Documented the invariant on `events.Event.Ts` and added a gotcha (#13)
in `AGENTS.md`: all event timestamps must be wall-clock at emit/observe,
never a monotonic/source clock.

### Test
- Added a linux-gated unit test asserting `kmsgparserSource` stamps
observation time, not the envelope's monotonic time

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Narrow telemetry timestamp fix in sysmon with documentation and a
focused unit test; no auth, API contract, or OOM parsing logic changes.
> 
> **Overview**
> Fixes **`system_oom_kill`** telemetry showing times far in the past on
scale-to-zero VMs by no longer using the kmsg envelope’s
monotonic-derived clock (which freezes while the VM is suspended).
> 
> **`kmsgparserSource`** now sets each `KmsgMessage.Timestamp` to
**`time.Now()`** at read time instead of the parser’s envelope
timestamp, so OOM **`TimeOfDeath`** and downstream **`events.Event.Ts`**
reflect when the record was observed. Comments on **`events.Event.Ts`**,
**`KmsgMessage`**, and **`OomInstance.TimeOfDeath`** document the
wall-clock-at-emit/observe rule; **AGENTS.md** adds gotcha **#13** for
all in-process producers.
> 
> Adds a **linux-gated** unit test with a fake kmsg parser to assert
observation time is stamped, not the envelope time.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
c140ce4. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

## Summary

This is the public-repo equivalent of the private runtime slimming PR.
It narrows the public Chromium runtime package install lists so the
final headless/headful images stop carrying build-time tooling that is
not used by the current runtime path.

What changed:
- Headless final runtime image: remove `build-essential`, `libssl-dev`,
`git`, and `software-properties-common`.
- Headful final runtime image: remove the old Python/pyenv-style build
block: `build-essential`, `libssl-dev`, `zlib1g-dev`, `libbz2-dev`,
`libreadline-dev`, `libsqlite3-dev`, `git`, `libncursesw5-dev`,
`xz-utils`, `tk-dev`, `libxml2-dev`, `libxmlsec1-dev`, `libffi-dev`, and
`liblzma-dev`.
- Headful final runtime image: remove the old `add-apt-repository
ppa:mozillateam/ppa` flow and its `software-properties-common`
dependency.
- Headful final runtime image: remove `python2` from the later runtime
install block.
- Both final runtime images: replace `gpg-agent` with `gpg`. The Envoy
installer needs the `gpg` binary for `gpg --dearmor`; it does not need
the agent package.

The net diff is only the two Dockerfiles.

## Why

The image already uses multi-stage builds for native/Xorg/neko build
inputs. Those build-stage dependencies stay where they are.

The packages removed here were still installed in the final runtime
image, where they increase image size and runtime surface area without
being referenced by the current launch/supervisor/API/browser path.

## Git History / Removal Rationale

The package history points to old image lineage rather than current
runtime requirements.

| removed item | why it appears to have been added | why this PR removes
it |
| --- | --- | --- |
| `build-essential`, `gcc`, `make` | Introduced in `5c71470` (`WebRTC
OSS launch`, PR #13) under a Dockerfile comment labeled `# Python/pyenv
reqs`. That commit moved the old unikraft/WebRTC image structure into
`images/chromium-*`. | Final runtime no longer builds Python or native
modules. Native/Xorg/neko compilation remains isolated in builder
stages. |
| `libssl-dev`, `zlib1g-dev`, `libbz2-dev`, `libreadline-dev`,
`libsqlite3-dev`, `libncursesw5-dev`, `tk-dev`, `libxml2-dev`,
`libxmlsec1-dev`, `libffi-dev`, `liblzma-dev` | Added in the same `#
Python/pyenv reqs` block from `5c71470`. These are typical compile
headers for Python/native dependency builds. | They are development
headers, not runtime browser/session packages. Current runtime paths use
installed shared libraries and copied artifacts, not compile headers. |
| `git` | Added with the old Python/build helper set in `5c71470`, and
also used in builder/release contexts elsewhere in the repo. | The final
image should not clone/build source at runtime. `git` remains available
in builder contexts where it is actually referenced. |
| `xz-utils` | Added in the old Python/pyenv block from `5c71470`,
likely to unpack source archives during legacy build flows. | Runtime
does not extract `.tar.xz` source archives. Downloader/build stages that
need archive handling keep their own tools. |
| `software-properties-common` / `add-apt-repository` | Added for old
PPA install paths in `5c71470`: `ppa:mozillateam/ppa` for headful and
`ppa:xtradeb/apps` for Chromium in the older image path. | Current
Dockerfiles do not install Firefox or use those PPA flows in the final
runtime package install. Keeping the PPA helper only preserves dead
install machinery. |
| `python2` | Added in `5c71470` with the old WebRTC/neko/demo runtime
setup. The remaining obvious Python script path is the legacy headful
demo payload handled separately. | Current public runtime startup is Go
wrapper/API + supervised services; no current runtime entrypoint
requires Python 2. |
| `gpg-agent` | Added later during apt/key setup work, but the actual
needed binary is `gpg`. | This PR keeps `gpg` because
`shared/envoy/install-proxy.sh` runs `gpg --dearmor`, and removes only
the agent package. |

## Measured Impact

Controlled local builds were run with `--no-cache` and unique cache IDs
during the split work.

| image | before | after | size delta | cold build |
| --- | ---: | ---: | ---: | ---: |
| public headless | 1985.2 MB | 1738.1 MB | -247.1 MB | 196s -> 173s |
| public headful | 2695.0 MB | 2329.3 MB | -365.7 MB | 347s -> 268s |
| private headless | 1975.6 MB | 1717.1 MB | -258.5 MB | 182s -> 183s |
| private headful | 2674.0 MB | 2296.9 MB | -377.1 MB | 332s -> 318s |

Exact final public numbers can shift slightly because this branch
intentionally keeps `gpg` after the Envoy installer dependency was
confirmed.

## Validation

Ran locally after merging current `main` into this branch:
- `git diff --check origin/main...HEAD`
- `DOCKER_BUILDKIT=1 docker build --check -f
images/chromium-headless/image/Dockerfile .`
- `DOCKER_BUILDKIT=1 docker build --check -f
images/chromium-headful/Dockerfile .`
- `cd server && go test ./e2e -run TestDoesNotExist -count=0`
- `~/.agents/skills/autoreview/scripts/autoreview --mode branch --base
origin/main --prompt-file /tmp/pr274-review-notes.md`

Autoreview note:
- Rejected the Firefox/PPA warning as not applicable after verifying the
branch does not install a `firefox` package. The relevant userland
install block contains `x11-apps`, `tint2`, `wget`, `xdg-utils`,
`libvulkan1`, `fontconfig`, and `unzip`; the image uses the copied
Kernel Chromium browser. The final autoreview rerun with that evidence
was clean.


GitHub Actions on the current-main refresh:
- image builds: passed
- server test/e2e job: passed
- launcher test, scan, and Socket: passed

## Unknowns / Final Gates

- The remaining product question is whether final runtime images are
expected to support arbitrary user process-exec workloads that require
`git`, compilers, Python 2, `xz`, or development headers. The current
repo/runtime paths do not show that dependency, but that is still the
compatibility decision to make before merging.
- Full image CI passed on the current-main refresh.

## Fast Docker Review

This PR follows the fast-build guidance by keeping build-only packages
out of the final runtime image. The Xorg/neko/native build inputs stay
in builder stages; the runtime stage only keeps packages needed by the
current browser/session path.

Against the checklist:
- Build tools and development headers are removed from final images
instead of being shipped to runtime.
- Existing multi-stage build boundaries stay intact; compiled artifacts
are still copied from builder stages.
- Stable dependency work remains before volatile application source in
the Dockerfiles.
- No new broad `COPY` statements or early source copies are added.
- `gpg` stays because the Envoy install step actually needs the `gpg`
binary; `gpg-agent` does not stay just because it used to be adjacent.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Docker-only runtime package list changes with no app code edits; main
risk is breaking workloads that relied on compilers, git, or Python 2
inside the final image.
> 
> **Overview**
> Narrows **final-runtime** `apt` installs in the public **headless**
and **headful** Chromium Dockerfiles so images stop shipping legacy
build/PPA tooling that the current Go wrapper, supervisor, and
Chrome-for-Testing path does not use.
> 
> **Headless** drops `build-essential`, `libssl-dev`, `git`, and
`software-properties-common` from the main runtime package block.
**Headful** removes the old `# Python/pyenv reqs` compile-header set,
`git`, `xz-utils`, the Mozilla PPA (`software-properties-common` +
`add-apt-repository`), and `python2` from the later runtime install.
**Both** swap `gpg-agent` for **`gpg`**, which
`shared/envoy/install-proxy.sh` needs for `gpg --dearmor` during Envoy
setup.
> 
> Multi-stage builders (e.g. `xorg-deps`, `ffmpeg-downloader`) are
unchanged; only what lands in the shipped runtime layer is trimmed, with
reported image size and cold-build time reductions.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
7182ebf. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

## Summary

This is the public-repo equivalent of the private dead-payload cleanup
PR, with the additional public-only tracked `server/api` binary removed.

What changed:
- Deletes `images/chromium-headful/image-chromium/`, including old demo
HTML, Streamlit config, static-content files, tint2 config, and legacy
startup scripts.
- Removes the broad `COPY images/chromium-headful/image-chromium/ /`
from the public headful Dockerfile.
- Deletes the tracked `server/api` binary artifact.
- Adds `server/api` to `.dockerignore` so local rebuilt API binaries do
not get sent in Docker build context.
- Leaves the current supervised headful runtime path intact: the image
still copies Neko config, supervisor service definitions, WebRTC client
output, Envoy config, cert bootstrap, API binary from the builder stage,
Chromium launcher, wrapper, Playwright daemon bundle, and extensions via
current explicit Dockerfile steps.

## Why

The removed `image-chromium` directory was an old payload copied
directly into `/` during the headful image build. The current image no
longer uses that legacy startup/demo path, and the broad root copy makes
it easy for unrelated files under `image-chromium` to silently land in
the final runtime image.

The tracked `server/api` binary is a local build artifact. The
Dockerfile compiles/copies the runtime API binary from the build stages;
it does not need a checked-in executable under `server/api`. Keeping it
tracked increases repository size and can invalidate Docker build
context/layers when the binary changes.

## Git History / Removal Rationale

| removed item | likely reason it was added | why it is removed here |
| --- | --- | --- |
| `entrypoint.sh`, `start_all.sh`, `xvfb_startup.sh`,
`mutter_startup.sh`, `tint2_startup.sh` | Added with the WebRTC OSS
launch (`5c71470`, PR #13) from the old headful demo image. These
scripts manually started Xvfb, tint2, mutter, x11vnc/noVNC, then
launched a demo server. | The current headful image uses supervisor
service definitions, wrapper scripts, Neko/WebRTC components, and
explicit Dockerfile copies. These legacy scripts are not the active
process model. |
| `http_server.py`, `index.html`, `static_content/index.html`,
`.streamlit/config.toml` | Added with the same demo payload. The old
entrypoint started a Python static server and Streamlit demo app and
printed local demo instructions. | The current public runtime does not
launch that demo stack. Keeping this content in `/` only preserves stale
files that are not part of the current browser/session path. |
| `.config/tint2/*` | Added to support the old desktop panel
configuration used by the demo/Xvfb/tint2 startup scripts. | Current
headful runtime behavior is managed by the current image service/config
path; this tint2 payload is only reachable through the removed legacy
startup scripts. |
| `COPY images/chromium-headful/image-chromium/ /` | Added during the
save/reuse user-data and supervisor transition. It preserved the old
root payload while the image moved toward explicit supervised services.
| The broad copy is now the risky part: any file under the legacy
directory silently mutates the final root filesystem. Current-purpose
files are already copied explicitly elsewhere in the Dockerfile. |
| `server/api` | Added as a 14 MB executable in `0fba5a0` (PR #148),
alongside smooth mouse movement source changes. A later PR (`9816e34`,
PR #164) added `server/api` to `.gitignore`, which strongly suggests it
was recognized as a local build artifact but was already tracked. | The
image build compiles the API from source; the tracked binary is not
referenced by Dockerfiles or runtime code. This PR removes it from git
and adds `.dockerignore` coverage so local rebuilds do not pollute
Docker context. |

## Validation

Ran locally after merging current `main` into this branch:
- `git diff --check origin/main...HEAD`
- `DOCKER_BUILDKIT=1 docker build --check -f
images/chromium-headful/Dockerfile .`
- `cd server && go test ./e2e -run TestDoesNotExist -count=0`
- `~/.agents/skills/autoreview/scripts/autoreview --mode branch --base
origin/main`

Autoreview result:
- Clean, no accepted/actionable findings.


GitHub Actions on the current-main refresh:
- image builds: passed
- server test/e2e job: passed
- launcher test, scan, and Socket: passed

## Unknowns / Final Gates

- The deleted legacy payload did not have current references after
removal. Full image CI passed on the current-main refresh.
- Public does not have the private CapMonster e2e test file that changed
in private PR #200, so this PR does not include that private-only test
hardening.
- The tracked `server/api` binary is removed from git, but local
developers can still build a local `server/api`; `.gitignore` and now
`.dockerignore` keep it out of commits and Docker build context.

## Fast Docker Review

This PR follows the fast-build guidance by removing dead build context
and a broad root copy from the headful image.

Against the checklist:
- The old `image-chromium` root payload copy is removed, so files cannot
silently land in `/` just because they sit under a legacy directory.
- The tracked `server/api` binary is removed and added to
`.dockerignore`, so local binary rebuilds do not invalidate image build
context or layers.
- The current runtime files continue to be copied explicitly where the
Dockerfile needs them.
- No build tools are added to runtime images, and no source copies are
moved earlier in the Dockerfile.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Dead files and a broad root COPY are removed; the active supervised
headful image path is unchanged and CI validated the Dockerfile build.
> 
> **Overview**
> Removes legacy **Computer Use Demo** payload from the public headful
image and stops shipping a checked-in API binary.
> 
> The entire `images/chromium-headful/image-chromium/` tree is deleted
(Streamlit/static HTML, tint2 panel config, Xvfb/tint2/mutter startup
scripts, and related demo entrypoints). The headful **Dockerfile** no
longer does `COPY images/chromium-headful/image-chromium/ /`; runtime
files continue to be copied explicitly (Neko, supervisor, Envoy, built
API from `server-builder`, etc.).
> 
> The tracked **`server/api`** executable is removed from the repo, and
**`server/api`** is added to **`.dockerignore`** so local rebuilds do
not bloat Docker build context or invalidate layers.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
fb7e962. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->