fix(docker): propagate OPENSHELL_IMAGE_TAG to cross-compile Dockerfiles

Three Dockerfiles that cross-compile CLI binaries via Docker were missing
ARG OPENSHELL_IMAGE_TAG declarations. The CI workflows and build scripts
already pass this as a --build-arg, but without the ARG declaration Docker
silently drops it. This caused Rust's option_env!("OPENSHELL_IMAGE_TAG")
to resolve to None at compile time, falling back to "dev" for
DEFAULT_IMAGE_TAG in stable release binaries.

Affected artifacts:
- macOS CLI binary (Dockerfile.cli-macos)
- Linux Python wheels (Dockerfile.python-wheels)
- macOS Python wheels (Dockerfile.python-wheels-macos)

The Linux CLI binary was not affected because it builds directly in the
CI container where OPENSHELL_IMAGE_TAG is set as a real env var.

Author: drew

deploy/docker/Dockerfile.cli-macos

@@ -103,9 +103,10 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
+# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
 # invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
+ARG OPENSHELL_IMAGE_TAG
 RUN --mount=type=cache,id=cargo-registry-cli-macos,sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-cli-macos,sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-cli-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \

deploy/docker/Dockerfile.python-wheels

@@ -84,9 +84,10 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
+# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
 # invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
+ARG OPENSHELL_IMAGE_TAG
 RUN --mount=type=cache,id=cargo-registry-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-python-wheels-${TARGETARCH}-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \

deploy/docker/Dockerfile.python-wheels-macos

@@ -91,9 +91,10 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
+# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
 # invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
+ARG OPENSHELL_IMAGE_TAG
 RUN --mount=type=cache,id=cargo-registry-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/git \
     --mount=type=cache,id=cargo-target-python-wheels-macos-${TARGETARCH}-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \