20260902 完成公开树清理与热点拆分

scripts/docker/build_image.sh

@@ -24,9 +24,9 @@ Options:
   --image <tag>          Image tag (default: panda-rpki-validator:<version>-<arch>)
   --out-dir <path>       Image archive/metadata directory (default: docker-out)
   --dockerfile <path>    Dockerfile path
-  --builder-image <tag>  Builder base image (M4 staging tag; pin before release)
-  --runtime-image <tag>  Runtime base image (M4 staging tag; pin before release)
-  --allow-dirty          Permit staging build and mark tag/metadata dirty
+  --builder-image <tag>  Builder base image (pin for a supported release)
+  --runtime-image <tag>  Runtime base image (pin for a supported release)
+  --allow-dirty          Permit a local build and mark tag/metadata dirty
   --no-binfmt            Do not install binfmt/qemu for a cross-architecture build
   --no-save              Do not write docker save archive
   --no-load              Build without loading the image into the local daemon
@@ -119,7 +119,7 @@ if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" || "$SOURCE_COMMIT_
   SOURCE_DIRTY=true
 fi
 if [[ "$SOURCE_DIRTY" == true && "$ALLOW_DIRTY" != 1 ]]; then
-  echo "refusing dirty staging tree; pass --allow-dirty for M4 development" >&2
+  echo "refusing dirty tree; pass --allow-dirty for a local development build" >&2
   exit 2
 fi