chore: capture Jenkins Docker baseline

agents/mplabx/Dockerfile

@@ -0,0 +1,72 @@
+FROM ubuntu:22.04
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        openssh-server openjdk-17-jre-headless git make build-essential \
+        curl unzip ca-certificates \
+        libxext6 libxrender1 libxtst6 libxi6 libusb-1.0-0 \
+    && rm -rf /var/lib/apt/lists/*
+# libX* above: MPLAB X's NetBeans-based platform pulls these in even for
+# headless/CLI use (mplab_ipe, make-based project builds). Drop them if you
+# confirm your specific build path never touches the IDE runtime.
+# libusb-1.0-0: required by the installer's own 64-bit library check (used
+# for MPLAB IPE's device programming/debug tool support).
+
+RUN useradd -m -s /bin/bash jenkins \
+    && mkdir -p /home/jenkins/.ssh /var/run/sshd \
+    && chmod 700 /home/jenkins/.ssh
+
+COPY secrets/agent_ssh_key.pub /home/jenkins/.ssh/authorized_keys
+RUN chown -R jenkins:jenkins /home/jenkins/.ssh \
+    && chmod 600 /home/jenkins/.ssh/authorized_keys
+
+# --- MPLAB X IDE + XC8/XC16/XC32 compilers ---------------------------------
+# Download these from https://www.microchip.com (account required) and place
+# them in installers/mplabx/ before building this image. See
+# installers/mplabx/README.md for expected filenames.
+COPY installers/mplabx/ /tmp/installers/
+RUN set -e; \
+    IDE_INSTALLER=$(ls /tmp/installers/MPLABX*.sh 2>/dev/null | head -n1); \
+    if [ -z "$IDE_INSTALLER" ]; then \
+        echo "ERROR: no MPLAB X installer (MPLABX-*-linux-installer.sh) found in installers/mplabx/. See installers/mplabx/README.md" >&2; \
+        exit 1; \
+    fi; \
+    chmod +x "$IDE_INSTALLER"; \
+    # These installers are makeself wrappers around an InstallBuilder elf
+    # installer: flags before "--" go to the makeself wrapper itself
+    # (--target, --nox11, ...); flags after "--" are passed through to the
+    # embedded installer (--mode, --unattendedmodeui, --installdir, ...).
+    # The wrapper's root check greps $USER (unset under plain `sh -c`, as
+    # Docker RUN uses) rather than trusting uid 0, so export it explicitly.
+    export USER=root; \
+    "$IDE_INSTALLER" --nox11 -- --mode unattended --unattendedmodeui none --installdir /opt/microchip/mplabx; \
+    # XC compiler installers ship in two different forms depending on
+    # version: a makeself-wrapped "*.sh" (same two-tier flag convention as
+    # the IDE installer above, taking --installdir) or a bare InstallBuilder
+    # elf "*.run" (flags passed directly, taking --prefix instead). Detect
+    # which by sniffing the first two bytes ("#!" vs the ELF magic).
+    for XC in /tmp/installers/xc8*.sh /tmp/installers/xc8*.run \
+              /tmp/installers/xc16*.sh /tmp/installers/xc16*.run \
+              /tmp/installers/xc32*.sh /tmp/installers/xc32*.run; do \
+        [ -f "$XC" ] || continue; \
+        chmod +x "$XC"; \
+        XC_NAME=$(basename "$XC" | cut -d- -f1); \
+        if [ "$(head -c2 "$XC")" = "#!" ]; then \
+            "$XC" --nox11 -- --mode unattended --unattendedmodeui none --installdir "/opt/microchip/$XC_NAME"; \
+        else \
+            "$XC" --mode unattended --unattendedmodeui none --prefix "/opt/microchip/$XC_NAME"; \
+        fi; \
+    done; \
+    rm -rf /tmp/installers
+
+ENV PATH="/opt/microchip/mplabx/mplab_platform/bin:/opt/microchip/xc8/bin:/opt/microchip/xc16/bin:/opt/microchip/xc32/bin:${PATH}"
+# The IDE installer also symlinks its main executables (mplab_ide, mplab_ipe,
+# mdb, prjMakefilesGenerator, projectPackager) into /usr/bin directly, so
+# they work even without the mplab_platform/bin entry above.
+# --installdir/--prefix above pin each install to an unversioned path, but
+# the bin/ subdirectory layout inside it can still vary by installer version
+# - if `docker compose run mplabx-agent which xc32-gcc` (or mdb, etc.) comes
+# up empty, inspect /opt/microchip/*/ in the built image and adjust PATH.
+
+EXPOSE 22
+CMD ["/usr/sbin/sshd", "-D"]