perf(combos): move gettext-base+curl to the benchmark base (drop per-combo standalone apt)

containers/core/benchmark-base-duckdb/Dockerfile

@@ -13,7 +13,7 @@ ARG DUCKDB_VERSION=1.5.3
 RUN set -e; ok=0; \
     for i in 1 2 3 4 5; do \
       if apt-get update --fix-missing && apt-get install -y --no-install-recommends \
-           curl ca-certificates unzip jq; then ok=1; break; fi; \
+           curl ca-certificates unzip jq gettext-base; then ok=1; break; fi; \
       echo "apt attempt $i failed; retry" >&2; sleep $((i*5)); \
     done; \
     [ "$ok" = 1 ] || { echo "apt install failed after 5 tries" >&2; exit 1; }; \

containers/core/benchmark-base-external/Dockerfile

@@ -20,7 +20,7 @@ RUN set -e; ok=0; \
       if apt-get update --fix-missing \
          && apt-get upgrade -y \
          && apt-get install -y --no-install-recommends \
-           curl ca-certificates git jq; then ok=1; break; fi; \
+           curl ca-certificates git jq gettext-base; then ok=1; break; fi; \
       echo "apt attempt $i failed; retry" >&2; sleep $((i*5)); \
     done; \
     [ "$ok" = 1 ] || { echo "apt install failed after 5 tries" >&2; exit 1; }; \

containers/core/benchmark-base-github/Dockerfile

@@ -14,7 +14,7 @@ RUN set -e; ok=0; \
       if apt-get update --fix-missing \
          && apt-get upgrade -y \
          && apt-get install -y --no-install-recommends \
-           curl ca-certificates git jq; then ok=1; break; fi; \
+           curl ca-certificates git jq gettext-base; then ok=1; break; fi; \
       echo "apt attempt $i failed; retry" >&2; sleep $((i*5)); \
     done; \
     [ "$ok" = 1 ] || { echo "apt install failed after 5 tries" >&2; exit 1; }; \

containers/core/benchmark-base-hf/Dockerfile

@@ -23,7 +23,7 @@ RUN set -e; ok=0; \
       if apt-get update --fix-missing \
          && apt-get upgrade -y \
          && apt-get install -y --no-install-recommends \
-           curl ca-certificates git jq; then ok=1; break; fi; \
+           curl ca-certificates git jq gettext-base; then ok=1; break; fi; \
       echo "apt attempt $i failed; retry" >&2; sleep $((i*5)); \
     done; \
     [ "$ok" = 1 ] || { echo "apt install failed after 5 tries" >&2; exit 1; }; \

containers/core/benchmark-base-python-slim/Dockerfile

@@ -15,7 +15,7 @@ LABEL eval.base.kind="python-slim"
 RUN set -e; ok=0; \
     for i in 1 2 3 4 5; do \
       if apt-get update --fix-missing && apt-get install -y --no-install-recommends \
-           jq ca-certificates; then ok=1; break; fi; \
+           jq ca-certificates curl gettext-base; then ok=1; break; fi; \
       echo "apt attempt $i failed; retry" >&2; sleep $((i*5)); \
     done; \
     [ "$ok" = 1 ] || { echo "apt install failed after 5 tries" >&2; exit 1; }; \

containers/core/benchmark-base-slim/Dockerfile

@@ -13,7 +13,7 @@ LABEL eval.base.kind="slim"
 RUN set -e; ok=0; \
     for i in 1 2 3 4 5; do \
       if apt-get update --fix-missing && apt-get install -y --no-install-recommends \
-           jq ca-certificates; then ok=1; break; fi; \
+           jq ca-certificates curl gettext-base; then ok=1; break; fi; \
       echo "apt attempt $i failed; retry" >&2; sleep $((i*5)); \
     done; \
     [ "$ok" = 1 ] || { echo "apt install failed after 5 tries" >&2; exit 1; }; \

containers/core/standalone.Dockerfile

@@ -54,12 +54,9 @@ FROM eval-base
 
 # ─── Gateway layer (uniform /opt/gateway/ contract) ──────────────────
 COPY --from=model /opt/gateway /opt/gateway
-# The gateway's start script uses envsubst to render its config template at
-# runtime. envsubst is part of `gettext-base` on Debian; the combination's base
-# is the benchmark image (Debian-slim), which doesn't have it. Install it here
-# (single-container mode is the only place the gateway runs in-process).
-RUN apt-get update && apt-get install -y --no-install-recommends gettext-base curl \
- && rm -rf /var/lib/apt/lists/*
+# The gateway's start script needs envsubst (gettext-base) + curl at runtime;
+# both now ship in the benchmark base, so this layer stays pure COPY — no
+# per-combo apt (that emulated install under QEMU was the combo-build bottleneck).
 
 # ─── OTel collector layer ────────────────────────────────────────────
 COPY --from=otel /otelcol                 /usr/local/bin/otelcol