fix(ci): pin druid cli for lgsm prebuild

Author: MarcStdt

AGENTS.md

@@ -12,6 +12,7 @@ Context for humans and coding agents working in this repository.
 
 - `.github/workflows/release.yml` installs `druid` from [highcard-dev/druid-cli](https://github.com/highcard-dev/druid-cli), validates scrolls, logs into the registry, pushes **categories**, then pushes individual scrolls.
 - When adding a new scroll family, you usually need both a **Push Categories** line (for that family’s `.meta`) and **Pushing new scrolls** lines for each version directory.
+- All production scroll/artifact changes must go through CI/CD. Do not manually push production scrolls or mutate production registry state unless explicitly authorized for an emergency; follow up with a repo change so CI is source of truth again.
 
 ## `druid registry push category` — three positional arguments
 

scripts/prebuild/prebuild.sh

@@ -4,11 +4,14 @@ set -e
 TAG=$1
 echo "Tag: $TAG"
 
+DRUID_CLI_VERSION=${DRUID_CLI_VERSION:-v0.1.227}
+echo "Druid CLI Version: $DRUID_CLI_VERSION"
+
 TMP_VOLUME_NAME=lgsm-prebuild-$(date +%s)
 
 docker volume rm $TMP_VOLUME_NAME || true
 
-docker run --rm -v $TMP_VOLUME_NAME:/app/resources bash sh -c 'wget -O /app/resources/druid-install-command.sh https://github.com/highcard-dev/druid-cli/releases/latest/download/druid-install-command.sh && mkdir -p /app/resources/deployment && chmod +x /app/resources/druid-install-command.sh && chown 1000:1000 -R /app/resources/'
+docker run --rm -v $TMP_VOLUME_NAME:/app/resources -e CHANNEL="$DRUID_CLI_VERSION" bash sh -c 'wget -O /app/resources/druid-install-command.sh "https://github.com/highcard-dev/druid-cli/releases/${CHANNEL}/download/druid-install-command.sh" && mkdir -p /app/resources/deployment && chmod +x /app/resources/druid-install-command.sh && chown 1000:1000 -R /app/resources/'
 
 echo "Pulling scroll"
 docker run --rm -v $TMP_VOLUME_NAME:/app/resources --entrypoint /app/resources/druid-install-command.sh -w /app/resources/deployment artifacts.druid.gg/druid-team/druid:latest-nix-steamcmd registry pull artifacts.druid.gg/druid-team/scroll-lgsm:${TAG}server