fix(docker): default the base-image ARG in updateUID.Dockerfile (#1242)

`ARG BASE_IMAGE` used by `FROM $BASE_IMAGE` without a default triggers BuildKit's
InvalidDefaultArgInFrom lint warning. Give it `=placeholder` (the real base image
is always supplied via --build-arg). Regression test added.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aledbf

internal/docker/updateUID.Dockerfile

@@ -1,5 +1,7 @@
 #  Licensed under the Apache License, Version 2.0. See LICENSE.txt in the project root for license information.
-ARG BASE_IMAGE
+# Default value avoids BuildKit's InvalidDefaultArgInFrom lint warning; the real
+# base image is always supplied via --build-arg BASE_IMAGE (docker.UpdateRemoteUserUID).
+ARG BASE_IMAGE=placeholder
 FROM $BASE_IMAGE
 
 USER root

internal/docker/updateuid_test.go

@@ -0,0 +1,17 @@
+package docker
+
+import "strings"
+
+import "testing"
+
+// TestUpdateUIDDockerfileArgHasDefault guards against reintroducing the
+// InvalidDefaultArgInFrom BuildKit warning: the ARG used by the FROM must carry
+// a default value (the real base image is passed via --build-arg). Upstream #1242.
+func TestUpdateUIDDockerfileArgHasDefault(t *testing.T) {
+	if !strings.Contains(updateUIDDockerfile, "ARG BASE_IMAGE=") {
+		t.Errorf("updateUID.Dockerfile must give ARG BASE_IMAGE a default to avoid InvalidDefaultArgInFrom")
+	}
+	if !strings.Contains(updateUIDDockerfile, "FROM $BASE_IMAGE") {
+		t.Errorf("updateUID.Dockerfile should still FROM $BASE_IMAGE")
+	}
+}