feat(pre-push-safety-net): reproduce evaluated Joern runtime

Dockerfile

@@ -11,7 +11,7 @@
 
 FROM eclipse-temurin:21-jre-noble
 
-ARG JOERN_VERSION=v4.0.623
+ARG JOERN_VERSION=v4.0.625
 ARG ARCHIVE=joern-cli-linux-x86_64.zip
 
 # php-cli is required by php2cpg, which drives PHP-Parser and shells out to a real interpreter. Without it a
@@ -25,12 +25,19 @@ RUN set -eux; \
     cd /tmp; \
     curl -fsSL -O "https://github.com/joernio/joern/releases/download/${JOERN_VERSION}/${ARCHIVE}"; \
     curl -fsSL -O "https://github.com/joernio/joern/releases/download/${JOERN_VERSION}/${ARCHIVE}.sha512"; \
-    sha512sum -c "${ARCHIVE}.sha512"; \
+    sed 's@  target/@  @' "${ARCHIVE}.sha512" > checksum.sha512; \
+    sha512sum -c checksum.sha512; \
     unzip -q "${ARCHIVE}" -d /opt; \
-    rm -f "${ARCHIVE}" "${ARCHIVE}.sha512"; \
+    rm -f "${ARCHIVE}" "${ARCHIVE}.sha512" checksum.sha512; \
     /opt/joern-cli/joern-parse --help > /dev/null
 ENV PATH="/opt/joern-cli:${PATH}"
 
+# This release ships the JS launcher with a .sh suffix; the backend's direct fallback uses
+# the same extensionless command convention as the other frontends.
+RUN if [ ! -e /opt/joern-cli/jssrc2cpg ] && [ -x /opt/joern-cli/jssrc2cpg.sh ]; then \
+      ln -s jssrc2cpg.sh /opt/joern-cli/jssrc2cpg; \
+    fi
+
 WORKDIR /app
 COPY pyproject.toml README.md ./
 COPY src ./src
@@ -43,7 +50,14 @@ RUN python3 -m venv /venv \
 ENV PATH="/venv/bin:${PATH}"
 
 # Analysis never needs root.
-RUN useradd --create-home --uid 1000 ousast && chown -R ousast /app
+# Noble may already provide the ubuntu account at UID 1000. Reuse that identity rather than
+# failing installation or creating a second account with the same UID.
+RUN if getent passwd 1000 > /dev/null; then \
+      usermod --login ousast --home /home/ousast --move-home "$(getent passwd 1000 | cut -d: -f1)"; \
+    else \
+      useradd --create-home --uid 1000 ousast; \
+    fi \
+ && chown -R ousast /app
 USER ousast
 
 ENTRYPOINT ["python", "-m", "openultrasast.cli"]