feat(installer): build worker source over SSH

internal/installer/harness/harness.go

@@ -168,6 +168,14 @@ func (h *Harness) Addr() string {
 	return net.JoinHostPort("127.0.0.1", strconv.Itoa(h.port))
 }
 
+// Port returns the published host port of the container's SSH listener
+// (the host is always 127.0.0.1). 0 before Start.
+func (h *Harness) Port() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.port
+}
+
 // Start builds the fixture image, starts the container, waits for real
 // SSH readiness, captures the server host key into a temp known_hosts
 // file, and records the published port. Every error path cleans up the
@@ -201,13 +209,10 @@ func (h *Harness) Start(ctx context.Context) error {
 	// docker run -d prints the container id directly, so no lookup is
 	// needed; the container name is the stable handle for later docker
 	// calls and the id is captured for diagnostics and assertions.
-	out, err := dockerCmd(
-		ctx, "run", "-d",
-		"--name", h.container,
-		"--network", h.network,
-		"-p", "127.0.0.1::22",
-		h.imageTag,
-	)
+	runArgs := []string{"run", "-d", "--name", h.container, "--network", h.network, "-p", "127.0.0.1::22"}
+	runArgs = append(runArgs, dockerDNS()...)
+	runArgs = append(runArgs, h.imageTag)
+	out, err := dockerCmd(ctx, runArgs...)
 	if err != nil {
 		return fmt.Errorf("start %s fixture container: %w", h.Fixture.Name, err)
 	}
@@ -244,6 +249,23 @@ func (h *Harness) Start(ctx context.Context) error {
 	return nil
 }
 
+// dockerDNS returns the `--dns` arguments to pin for fixture containers,
+// parsed from the comma-separated RSMON_TEST_DOCKER_DNS environment
+// variable. It is empty by default (Docker's embedded DNS). The override
+// exists so environments with flaky local resolvers can pin a reliable
+// upstream for the internet-facing installs (go.dev, rocketgit.ru,
+// proxy.golang.org), which would otherwise fail intermittently on DNS
+// timeouts.
+func dockerDNS() []string {
+	var args []string
+	for _, ns := range strings.Split(os.Getenv("RSMON_TEST_DOCKER_DNS"), ",") {
+		if ns = strings.TrimSpace(ns); ns != "" {
+			args = append(args, "--dns", ns)
+		}
+	}
+	return args
+}
+
 // Stop releases every resource the harness created: the container, its
 // dedicated network, the per-instance fixture image tag (never a shared
 // base image), and the temp known_hosts directory. It is idempotent and