DEVOPS-14554: consolidate atmos-runner tooling into github-runner

[Nabulio]

Summary

• Add helm v3.14.3, helmfile v1.2.3, kubectl v1.29.4, helm-diff v3.12.2, infracost v0.10.40 to the image
• Bump atmos v1.195.0 → v1.207.0
• Remove redundant aqua block (duplicate tfcmt + terraform-docs install)
• Set HELM_DATA_HOME=/usr/local/share/helm so helm-diff plugin is found regardless of $HOME
• Use ARGs for all tool versions (single source of truth)
• Update test workflow to verify all tools

This is the first step of the image consolidation: once merged and deployed, we can remove container: directives from devops-multiaccount CI workflows and drop the dind sidecar from the RunnerSet.

Test plan

• Local docker build succeeded
• All tools verified inside container (atmos, terraform, tfcmt, terraform-docs, infracost, helm, helmfile, kubectl, helm diff, aws)
• HELM_DATA_HOME correctly set, plugin found
• Runner user has execute permissions on all binaries
• Python 3.11 and Node.js still functional
• CI test-docker-image.yaml passes on this PR

[Copilot]

Pull request overview

This PR consolidates additional DevOps tooling into the github-runner container image to reduce reliance on external installs during CI runs and support upcoming workflow simplifications.

Changes:

• Adds Kubernetes tooling (Helm, Helmfile, kubectl) plus helm-diff, and adds Infracost to the image.
• Bumps Atmos to v1.207.0 and centralizes tool versions via Dockerfile ARGs.
• Expands the CI workflow to verify the newly preinstalled tools inside the built image.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
Dockerfile	Introduces version ARGs and installs additional IaC/Kubernetes tooling (including helm-diff via plugin install) directly into the runner image.
.github/workflows/test-docker-image.yaml	Extends the tool verification step to validate the newly added binaries/plugins within the test image.

Comments suppressed due to low confidence (1)

Dockerfile:23

• This apt-get layer leaves /var/lib/apt/lists/* behind (and removing it in a later layer won’t reduce image size). Consider cleaning apt lists in the same RUN after installing nodejs to keep the image smaller and reduce CVE surface from stale package indices.

RUN sudo apt-get update && \
    sudo apt-get install -y git unzip zip jq openssh-client curl git-lfs perl && \
    sudo apt-get clean && \
    curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
    sudo apt-get install -y nodejs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.